Tuesday, November 29, 2016

PayPal & Bank - haccking Transfer (+10.000 usd daily)

Western Union, Bank, Paypal transfer - Haacking and Caarding transfer. Maximum 9.999$ daily.

More details on our underground market:
http://***.cc/showthread.php?tid=1201

Email analysis :

NOTE : X-Msmail-Priority : Normal
NOTE : Return-Path : < admin@black-hack.su >
NOTE : X-Mimeole : Produced By Microsoft MimeOLE V15.4.3538.513
NOTE : X-Remote : 66.42.85.200 (keevan.fire2wire.com)
NOTE : Organization : DarkMarket
NOTE : Mime-Version : 1.0
NOTE : X-Priority : 3
NOTE : X-Mailer : Microsoft Windows Live Mail 15.4.3538.513
NOTE : Received : from keevan.fire2wire.com (66.42.85.200)


NOTE : Received : from [155.133.82.113] (helo=155.133.82.113)


NOTE : by keevan.fire2wire.com with esmtpsa (TLSv1:AES256-SHA:256)
NOTE : (Exim 4.69) (envelope-from < admin@black-hack.su >)
NOTE : PayPal & Bank - haccking Transfer (+10.000 usd daily)

New incoming Fax from 908.8325722

You Have a new Fax message
From: 908.8145483
Receiving date: November 28, 2016
Pages: 3

You can view your message on our website:
https://service.ringcentral.com/ messages/download.aspx?fax_id=1805802

Thank you for using RingCentral.

Link analysis :

CLICK : https://service.ringcentral.com/ messages/download.aspx?fax_id=1805802
OPEN : http://787.vn/wp-content/themes/tourpackage-v1-02/backup/get.php?id=dGVzdEB0ZXN0LmNvbQ==
DOWNLOAD : fax_test.doc

File analysis :


OPEN : fax_test.doc
SHA256 : c0b3934b594a23dd88a42c0e96ccbbf7f88c633a19d82833d6d9bbf47630a0c1
RESULT : fax_test.doc is a virus

Virus analysis :

Avast : VBA:Downloader-DSL [Trj]
ClamAV : Doc.Dropper.Agent-1847249
Kaspersky : Trojan-Downloader.MSWord.Agent.avj
Qihoo-360 : virus.office.gen.70
Sophos : Troj/DocDl-FTZ
Symantec : W97M.Downloader

Email analysis :

NOTE : ringcentral@faxmessage.com
NOTE : 74.143.65.242 (rrcs-74-143-65-242.central.biz.rr.com)


NOTE : Mime-Version : 1.0

Compensation Payment,

Attn: Beneficiary

I wish to inform you were among the scam victims listed to be released their overdue funds by the UNITED NATIONS in conjunction with the International Monetary Fund (IMF) after the last encounter we held concerning your funds. As directed by UN secretary General Ban Ki-Moon in collaborations with the IRS, I wish to state categorically that a transfer of $10,500,000.00 will be made to your bank account as almost 99% cost associated with the transfer of your funds has been prepaid by the U.S. Government. The only fee you will pay is the cost of processing a "Fund Clearance Certificate" by the paying bank. The "Fund Clearance Certificate" is required in accordance with the U.S. Monetary Transfer or deposit Policy and it is the only fee you will have to pay before your funds can be transferred to your account. After you have paid for the above mentioned certificate, the paying bank will process it and send a copy of it to you for your perusal.

Note once again that your overdue payment will be credited into your account you will furnish with the Bank without any delay as approved by United Nations, International Monetary Fund, World Bank, and United States Government.

However, this is to inform you that we have been mandated by the United Nations Compensation Commission (UNCC) department through the Financial Crimes Enforcement Network (FinCEN) of the United States Department of the Treasury to release your overdue funds directly from the United Nations Compensation Fund Account via Telegraphic Transfer into your designated bank account. Note that the above sum is the payment of compensation awarded to you for losses and trauma resulting directly from scam committed against you in line with the Resolution 1483 (2012) adopted by the United Nations Security Council Headquarters in New York following series of complaints by the victims of scam.

Urgently respond with your full name, full address, copy of identification and direct phone number so that I will furnish you with the contact information of the paying bank. Remember, they will instruct you on how to send the money to them as soon as you contact them.

Yours Sincerely,

Ms. Heidi Mendoza
Head Of United Nations Under-Secretary- General
For Internal Oversight Services.

Email analysis :

NOTE : office1001967@gmail.com
NOTE : mra0@un.org
NOTE : Received : from User (host-185-13-247-42.razorblue.net.uk [185.13.247.42])


NOTE : by mx-out-b.razorblue.net.uk (Postfix)

Monday, November 28, 2016

miracle omani


I want to tell you something respond to me

Email analysis :

NOTE : miracloem@gmail.com
NOTE : Mime-Version : 1.0
NOTE : X-Yahoo-Newman-Property : ymail-3
NOTE : queetqueem@yahoo.com
NOTE : Content-Type : text/plain; charset=UTF-8

Attension

Attension,

This is to brought to your notice that i am the new manager of united bankf for african and here i go through bank draft and i can see that you have not receive your over drawft payment which it has been program for transfer into your norminated bank account. Has i go throught your dafault file,i can see your that your total fund is $6.5milion united sates dollars, Please you are advise to get us the requested information below.

Your Full Name=================
Your Direct Phone No.==========
Your Bank Account No.==========
Swift Code=====================
Occupation==========
Bank Address/Bank Phone No.====

Copy of your identity/driving licence

Once this require information are provided, we shall commence on the next step of your transaction. You are advise to contact us through our bank e-mail (united.bankforafrica@mail.ru )or via phone contact +229-98-328-353

WE REMAIN TO SERVE YOU BETTER IN BANKING SECTOR.

THANKS BEST REGARD

Dr. Philip Ezeson
EXECUTIVE GOVERNOR FUND RECOVERY COMITTEE
E-MAIL: ( united.bankforafrica@mail.ru )
TELL +229 98-328-353
FAX +229 0 01 63 802

Email analysis :

NOTE : united.bankforafrica@mail.ru
NOTE : "WW."@sage.ocn.ne.jp
NOTE : Received : from mzkstore613.ocn.ad.jp
NOTE : (mz-ukg613p.ocn.ad.jp [153.149.211.230])
NOTE : X-Originating-Ip : [62.75.138.143]

Friday, November 25, 2016

Dear in Christ.

Donation From Mrs Jessica Sebastian
BP [38 Rue Des Martyrs Cocody)
Abidjan, Cote d'Ivoire,

Dear in Christ.

I am Mrs Jessica Sebastian an ageing widow suffering from long time illness. I am currently admitted in a private hospital in Abidjan Cote d‘Ivoire,I have some funds I inherited from my late loving husband Mr Raymond Sebastian, the sum of £ 5.200.000 ( Five Million Two Hundred Thousand Euro ) which he deposited in bank here and I need a very honest and God fearing Christian that can use these funds for God's work and 15% out of the total funds will be for your compensation for doing this work of God.I found your email address from the internet and decided to contact you

Please if you would be able to use these funds for the Lord's work kindly reply me.

Send me the following information's as per below.

Your full names........................
Address .......................
Age ...............................
Occupation ....................................
photo................................

Your Sister in the Lord.
Mrs. Jessica Sebastian

Email analysis :

NOTE : sabastian_jessica@yahoo.com
NOTE : jessica.sabastian13@gmail.com
NOTE : X-Rocketymmf : gojo_t
NOTE : X-Mailer : YahooMailWebService/0.8.111_70
NOTE : Received : from [178.162.216.35]

Toyota Job Recruitment Offer

Attention;

Toyota Motor Corporation is glad to inform you that you have been shortlisted to work with our company in the UK. For more details, see attached letter and confirm your acceptance by email as soon as possible.

Sincerely,
David Crouch,
General Recruitment Manager, PR

Email analysis :

NOTE : toyota.recruitments@gmail.com
NOTE : admin@noreply.com
NOTE : 94.182.146.33 ()

MRS.INNA KHODORKOVSKY GREETINGS

DR. WEST PRIVATE MEDICAL
CENTER PETROVERIGSKY PER.10
101990 MOSCOW RUSSIAN FEDERATION

Dear

I AM MRS.INNA KHODORKOVSKY WIFE TO LATE MR. MIKHAIL BORIS KHODORKOVSKY OF BLESSED MEMORY WHO IS AN OIL EXPLORER IN SINGAPORE AND KUWAIT FOR TWENTY FIVE YEARS AND FOUR MONTHS. BEFORE HE DIED IN THE YEAR 2010.WE WERE MARRIED FOR TWELVE YEARS WITHOUT A CHILD. HE DIED AFTER A BRIEF ILLNESS THAT LASTED FOR ONLY FOUR DAYS AFTER HIS DEATH I TOO HAVE BEEN BATTLING WITH BOTH CANCER AND FIBROID PROBLEMS.WHEN MY HUSBAND WAS ALIVE HE DEPOSITED THE SUM OF $38,000,000 (THIRTY EIGHT MILLION UNITED STATE DOLLARS) SOME WERE IN OVERSEAS. RECENTLY MY DOCTOR TOLD ME THAT I HAVE ONLY SIX MONTHS TO LIVE DUE TO CANCER PROBLEM, THOUGH WHAT DISTURBS ME MOST IS MY CANCER SICKNESS AND HAVING KNOWN MY CONDITION I DECIDED TO DONATE THIS FUND TO EITHER A CHRISTIAN OR MUSLIM ORGANIZATION OR A DEVOTED CHRISTIAN OR MUSLIM INDIVIDUAL WHO WILL UTILIZE THIS MONEY THE WAY I AM GOING TO INSTRUCT HEREIN. I WANT THIS CHRISTIAN OR MUSLIM ORGANIZATION OR INDIVIDUAL TO USE THIS MONEY IN ALL SINCERITY TO FUND MOSQUE OR CHURCHES, ORPHANAGE, WIDOWS AND GENERALLY PEOPLE IN NEED. I TOOK THIS DECISION BECAUSE I DON'T HAVE ANY CHILD THAT WILL INHERIT THIS MONEY AND MY HUSBANDS RELATIVES ARE SO SELFISH AND HAVE LOATHED THE REST OF MY LATE HUSBANDS PROPERTIES. SO I DON'T WANT A SITUATION WHERE BY THIS MONEY WILL BE USED IN WASTEFUL MANNER, HENCE THE REASONS FOR THIS BOLD DECISION. I DON'T NEED ANY TELEPHONE COMMUNICATION IN THIS REGARD BECAUSE OF MY HEALTH, AND ALSO BECAUSE OF THE PRESENCE OF MY HUSBAND'S RELATIVES AROUND ME ALWAYS. I DON' T WANT THEM TO KNOW ABOUT THIS DEVELOPMENT, AS SOON AS I RECEIVE YOUR REPLY, I SHALL GIVE YOU THE CONTACT INFORMATION AND THE COUNTRY IN OVERSEAS WHERE THE MONEY WAS DEPOSITED.I WILL ALSO ISSUE A LETTER OF AUTHORIZATION TO YOU AUTHORIZING THEM TO RELEASE MY FUND TO YOU.I WANT YOU AND THE CHRISTIAN OR MUSLIM COMMUNITY WHERE YOU RESIDE TO ALWAYS PRAY FOR ME. ANY DELAY IN YOUR REPLY WILL GIVE ROOM IN SEARCHING FOR ANOTHER CHRISTIAN OR MUSLIM ORGANIZATION OR A DEVOTED MAN OF GOD FOR SAME PURPOSE. THIS MONEY WILL BE USED TO OPEN A CHARITY ORGANIZATION IN MY NAME WHICH WILL BE CALLED (INNA HOME) IN YOUR COUNTRY BUT WILL BE MANAGED BY YOU.SECONDLY YOU WILL HELP TRANSFER ME TO A BETTER HOSPITAL IN YOUR COUNTRY THAT IS STANDARD AND WELL EQUIPPED BECAUSE WERE I AM PRESENTLY DON’T HAVE STANDARD EQUIPMENTS TO TREAT ME. YOU WILL DO THIS WHEN YOU RECEIVE MY MONEY SO THAT I CAN SEE IF I WILL LIVE MORE DAYS. DUE I WILL TELL YOU HOW MUCH YOU WILL TAKE FROM THIS MONEY FOR YOUR OWN PERSONAL USE AND THE REST WILL BE USED AS I HAVE INSTRUCTED. TILL I HEAR FROM YOU, MY DREAMS WILL REST SQUARELY ON YOUR SHOULDERS. I WILL SEND YOU MY PICTURE IN THE HOSPITAL, AND MY CERTIFICATE OF DEPOSIT AS AT THE TIME OF DEPOSIT. PLEASE MY DEAR, AM SORRY TO TELL YOU THIS, THERE WILL BE A LITTLE EXPENSES TO BE MADE BY BOTH OF US, SINCE MY LATE HUSBAND DEPOSITED THIS $38 MILLION IN A SECURITY COMPANY IN THE YEAR 2010 AND IT HAS ACCUMULATED A DEMURRAGE FEE.

IF ALL I HAVE WRITTEN IS OK WITH YOU, SEND ACROSS TO ME THE FOLLOWING

(1) YOUR FULL NAMES
(2) YOUR TELEPHONE NUMBER
(3) AGE AND OCCUPATION
(4) MARITAL STATUS AND ADDRESS

FOR FURTHER PROCESSING TO RECEIVE MY FUND ON YOUR NAME. AS I READ FROM YOU I WILL FEED YOU WITH MORE DETAILS PLEASE
REGARDS.

MRS. INNA KHODORKOVSKY

Email analysis :

NOTE : mnnakhodorkosky@gmail.com
NOTE : mnnakhodorkosky@mail.com.ru
NOTE : 46.36.217.65 ()

Thursday, November 24, 2016

bill 73726332

See you in court !!!

Subpoena for

Matthew Riley

Link analysis :

CLICK : Subpoena for
OPEN : http://techsmart.vn/backup/get.php?id=d2VibWFzdGVyQHJiY2FmZS5jb20=
RESULT : 404 Error...

Email analysis :

NOTE : matthew@trattnerlaw.com
NOTE : Received : from unknown (HELO trattnerlaw.com) (190.108.92.109)

,

Cash Grant

Hello.

I'm Raymond Scott Bells, My wife and I won $50-million Lotto Max cheque,in Edmonton,we have decided to donate to the less privileged and charity projects all over the world, and make at least 5 people millionaires.

To verify, please see our interview by visiting the web page below.

http://www.ctvnews.ca/canada/after-life-of-struggle-alberta-truck-driver-wife-win-50m-lotto-prize-1.2526163

Get back to me with your name,address,Gender,Country and phone number for more details on how you can receive

your Cash Grant.

Here is my personal email raymondsbells@yandex.com contact me as soon as possible.

Stay Bless

Mr Raymond Scott Bells

Email analysis :

NOTE : raymondsbells@yandex.com
NOTE : maggib@btnet.is
NOTE : client-ip=5.23.79.39;

Tuesday, November 22, 2016

Maerskline Shipping BL (Phishing + Virus)

FYI

Please see attached shipping documents.

1 attachment(s)
Download | View

Best Regards

MAERSK LINE
One Commercial Place, 20th Floor
Norfolk, VA 23510
Phone: 757-857-4800
Fax: 757-852-3232
© Maersk Group.

Virus :

CLICK : DOWNLOAD
OPEN : http://original-documents.alkhalifa.pw/document/FAX_001.zip
RESULT : UNRESPONSIVE

Phishing analysis :

CLICK : View
OPEN : http://eretailday.org/img/shippingdoc/index.html
SCREENSHOT :


VALIDATE : FORM
REDIRECT : https://my.maerskline.com/?_nfpb=true&_pageLabel=page_tracking3_trackSimple

Email analysis :

NOTE : logistics@maerskline.com
NOTE : Received : from unknown (HELO ?192.168.2.254?)
NOTE : (198.72.31.234)

XMAS LOAN OFFER

2% LOAN OFFER APPLY NOW *

You lose sleep at night care how to get a loan?
* Are you looking for a loan to pay the debt?
* Are you looking for a loan to start your own business?
* Are you looking for loans to large projects perform?

CONTACT US TODAY...FAST LOAN INVESTMENT.......forward your reply here :
firstonlineloaninvesment@gmail.com

Fill out the for m to your loan application:

Name:
Country:
Amount Of Loan Needed:
Occupation:
Monthly Income:
Phone:
Length oF The Loan (years):

Note: All mail must be sent to: firstonlineloaninvesment@gmail.com

I hope to live your financial expectations.

Thank You.
2016 FIRST LOAN Co-operation

Email analysis :

NOTE : firstonlineloaninvesment@gmail.com
NOTE : plan_follow@scmt.gov.iq
NOTE : Received : from [41.113.85.128] (port=48514 helo=[172.20.10.5])


NOTE : by alsco.cloudscis.com with esmtpa (Exim 4.87)
NOTE : (envelope-from < plan_follow@scmt.gov.iq >)
NOTE : alsco.cloudscis.com : authenticated_id: plan_follow@scmt.gov.iq

Your LogMein.com subscription has expired! (Virus)

Dear client,

You are receiving this message because your subscription for LogMeIn Central has expired.
We were not able to charge you with the due amount because your credit card was declined.

You can download the bill directly from the LogMeIn website:
https://accounts.logme.in/billing.aspx?clusterid=0724&view_bill_id=3716 4647&file_type=doc

Please use another credit card or payment method in order to avoid complete service interruption.

Event type: Credit Card Declined
Account email: *.*
At: 21/11/2016

If you need more help, visit LogMeIn Support at:
http://solutions.logmein. com/SalesContactUs

Important Security Notice:
LogMeIn will never for your password or other sensitive information by email.

(Please don't reply to this email, as it's sent from an address that's not monitored.)

© LogMeIn Inc

Virus analysis :

CLICK : https://accounts.logme.in/billing.aspx?clusterid=0724&view_bill_id=3716 4647&file_type=doc
OPEN : https://reg.vn/en/view_bill.php?id=d2VibWFzdGVyQHJiY2FmZS5jb20=
DOWNLOAD : lgm_bill89831.doc
lgm_bill89831.doc : VIRUS


lgm_bill89831.doc analysis :

SHA256 : fc1f1845e47d4494a02407c524eb0e94b6484045adb783e90406367ae20a83ac
FILE : lgm_bill89831.doc
ALYac : Trojan.Downloader.W97M.Gen
Ad-Aware : W97M.Downloader.ESE
AegisLab : Troj.Downloader.Msword.Agent!c
Arcabit : W97M.Downloader.ESE
BitDefender : W97M.Downloader.ESE
Cyren : W97M/Nastjencro
ESET-NOD32 : VBA/Kryptik.T
Emsisoft : W97M.Downloader.ESE (B)
F-Prot : New or modified W97M/Nastjencro
F-Secure : Trojan:W97M/Nastjencro.A
GData : W97M.Downloader.ESE
Ikarus : Trojan-Downloader.VBA.Agent 20161121
Kaspersky : Trojan-Downloader.MSWord.Agent.auz
McAfee : W97M/Dropper.cu
McAfee-GW-Edition : W97M/Dropper.cu
eScan : W97M.Downloader.ESE
Microsoft : TrojanDownloader:O97M/Donoff!map
Sophos : Troj/DocDl-FQK
Symantec : W97M.Downloader
Tencent : Win32.Trojan.Inject.Auto
TrendMicro : W2KM_HANCITOR.AUSTT
TrendMicro-HouseCall : W2KM_HANCITOR.AUSTT

Email analysis :

NOTE : billing@secure-lgm.com
NOTE : Received : from wsip-70-165-74-172.hr.hr.cox.net
NOTE : (HELO secure-lgm.com) (70.165.74.172)

IN GOD I TRUST....212

Federal Ministry of Agriculture and Natural Resources
Address FCDA Secretariat, Garki
City Abuja
Phone +234 9 314 1931
Fax +234 9 314 2532
http://www.fmard.gov.ng/
P.M.B. 135, Garki, Abuja, FCT

Dear Friend

It is with trust and confidence that i write to make this urgent business proposal to you.i was assigned by two of my colleague to seek for a foreign partner who will assist us in providing a convenient foreign account in any designated bank abroad for the transfer of us$35,500,000.00 pending on our arrival in your country for utilization and disbursement with the owner of the account.

this amount results from a deliberate inflation of the value of a contract awarded by our ministry - the federal ministry of agriculture (F.M.A)to an expatriate company.the contract has been executed and payment made to the original contractor,remaining the over-invoiced amount of us$35.5 million,which we want to transfer the funds out the country in our favor for disbursement among ourselves.the transfer of this money can only be possible with the help of a foreigner who will be presented as the beneficiary of the fund.

as government officials, we are not allowed to operate foreign accounts,and this is the reason why we decided to contact you. we have agreed that if you/your company can act as the beneficiary of this fund (us$35,500,000.00 million)25% of the total sum will be for you for providing the account while 5% will be set aside for the expenses incurred during the cost of transfer of the fund into your account while 70% will be reserved for us.

we hereby solicit for your assistance in providing a convenient account number in a designated bank abroad where this fund would be transferred.we intend coming over there on the completion of this transfer to secure our own share of the money.

please note that we have been careful and have made all arrangements towards the success and smooth transfer of the fund to your account before you. for security reasons and confidentiality of this transaction, we demand that you should not expose this proposal and the entire transaction to anybody.

we are putting so much trust in you with the hope that you would not betray us. or sit on this money when it is finally transferred into your account.be rest assured that this transaction is 100% risk free. if this proposal is acceptable to you,indicate your interest by sending a email to us including your bank name & address,account number,telephone and fax numbers.

note:our former president Dr.Good luck Ebele Jonathan collaborated with the former chairman of the Economic Financial Crime Commission,Mrs Farida Mzamber Waziri to stop the junior ranks officers from transferring funds out of the country. he sent different publication to many countries in the world as propaganda to discourage all government officials from transferring funds into an overseas account to avoid and save guides the countries economy.

apparently, so that other government officials will not benefits from these( oil windfalls venture) where he has been a culprit alone with his aides.more details about this transaction will be given to you as soon as we receive your positive respond.

note that the particular nature of your company's business is irrelevant to this transaction. if this transaction interests you, your urgent response will be appreciated.

yours faithfully,

Dr.Evans Egobia

Email analysis :

NOTE : drevanegobia2@yahoo.com
NOTE : accdeptfedminagric1@naij.com
NOTE : mail.kapakli.bel.tr
NOTE : Received : from User (197.255.171.250)


NOTE : by MAIL.KAPAKLI.BEL.TR (192.168.34.251)
NOTE : Remote : 212.156.146.234 (mail.kapakli.bel.tr)

DHL DELIVERY COURIER COMPANY

DHL DELIVERY COURIER COMPANY
Rue no. 23 Patte D'oie 03 BP 2147 Cotonuo
Headquarter Cotonuo Benin
E-mail: shipping.unit@web.co.zw
Office Telephone: +229-66673 695

Hello my dear,

Good day and how are you today? Having reviewed all the obstacles and problems surrounding your over due inheritance funds valued $2.5Million USD (Two Million Five Hundred Thousand United States Dollars) payment and your inability to meet up with the charges required due to unnecessary protocols involved. It is my great pleasure to inform you that we have successfully arranged with UBA Bank Director, Dr. Ifeatu Onejeme to covert your above mentioned fund which was originally in a Consignment box into ATM Visa Card and ready for delivery to your door step. I am happy when UBA Bank Director, Dr. Ifeatu Onejeme called me that all the necessary arrangement has been completed that he has converted the total amount into ATM Card in your name, after which I went to DHL Courier Company and have it registered for onward delivery to your address. Kindly study bellow information for your deposit details:

Description: UBA BANK (ATM CARD)
Depositor: Linda Conti
Deposit Number: DHL-101-PL45
Deposit Certificate N0.E405576
Sort/Clearance Code: DHL/101-45/P50

According to Mrs Linda Conti, you can able to withdraw $2,500.00 per each withdrawal at daily limit of $10,000.00 until you withdraw your total $2.5Million from the ATM CARD. So all you need is to write application letter to bellow DHL Courier Company contact information or call their foreign operation department Dr Andrew Leek for immediate delivery schedule of your ATM CARD to any address of your choice.

Contact Person: Dr. Maxwell Kobo (Foreign Operation Department)
DHL Courier Company Cotonuo Benin,
Plot No. 23 Patte D'Oie 03 BP 2147 Cotonuo
Telephone Number: 00 229-666 73 695
Email: shipping.unit@web.co.zw

Don't forget to reconfirm your current data as Dr. Maxwell Kobo requested to enable their delivery agent succeed. Herein is what they need from you

1. Your Full Names:_____________
2. Postal Address:________________
3. Direct Cell Numbers:_______
4. E-mail Address:__________________
5. Sex:_____________________
6.Age:______________________
7. Occupation:__________________
8.Nationality:________________
9.Country Name________________
10.Copy of Your Passport/ Drivers Licenses________________

Please hurry up now as your package might attract more charges if it stays more than 3days with DHL and do keep me posted for record updated.

Thanks and remain blessed

Best Regards,
Mr. Johnson Williams
IMF Head Quarter Dept Reconciliation Committee
Benin Republic

Email analysis :

NOTE : zinou1959@gmail.com
NOTE : imffund65@gmail.com

pin code Number BMW:2551256003/23.

BMW LOTTERY DEPARTMENT
5070 WILSHIRE BLVD
LOS ANGELES. CA 90036
UNITED STATES OF AMERICA.

NOTE: If you received this message in your SPAM/BULK folder, that is because of the restrictions implemented by your Internet Service Provider, we (BMW) urge you to treat it genuinely.

Dear BMW Enthusiast,

This is to inform you that you have been selected for a prize of a brand new 2016 Model BMW 7 Series Car and a Check of $500,000.00usd from international programs held this Final quarter of 2016 in NC, UNITED STATES OF AMERICA. The selection process was carried through a random computerized selection process in our email selection system(ESS), from a database totalling over 250,000 email addresses drawn from all the continents. The BMW Lottery is approved by the British Gaming Board and also Licensed by the International Association of Gaming Regulators (IAGR). To begin the processing of your prize you are to contact our BMW fiduciary claims department for more information as regards procedures to claim your prize.

Verification Agent: Mr. Derek Weir
Contact E-mail: der_weir@mail.com

Contact him by identifying your claim with the pin code Number BMW:2551256003/23. You are also advised to provide him with the under listed information:

1. Name in full.
2. Address.
3. Nationality.
4. Age.
5. Phone/Fax.
6. Present Country.
7. Email address.
8. pin code Number BMW:2551256003/23.

BMW CEO Harald
THE DIRECTOR PROMOTIONS

BMW SALES LOTTERY DEPARTMENT

UNITED STATES OF AMERICA

Email analysis :

NOTE : der_weir@mail.com
NOTE : eric@topperblue.com
NOTE : X-Mdremoteip : 191.55.3.165
NOTE : 114.112.79.15 (smtp14.smtp.yun-idc.com)

Anthony Dozie

Hello

I make this contact believing we will be supporting each other in developing a long lasting cordial business relationship. I am moved by my inspiration to trust you.

On August 27, 2007 one of my friends died in a car accident along Manchester motorway. Unfortunately, both driver and passenger lost their lives and my deceased friend had no wife or children before his death. I asked to find his extended relatives, no person.

Three weeks ago I noticed a letter from a Safety Deposit Centre on their plan to confiscate funds from my late friend (Valued US $ 15.5 million) if I fail to bring any relative to my deceased friend. The fact you come from his country of origin and have same last name as my deceased friend, makes you credible.

Together we will avoid confiscation of the account and claim the funds. Therefore, I have made consultation with a lawyer who can get all the necessary legal documents to back up your claims as heir, and he assured me his professional support.

Sincerely
Anthony Dozie
anthonydozie17@yahoo.com

38 Queen Street
Orrell,
Wigan WN5 0AE
England

Email analysis :

NOTE : anthonydozie17@yahoo.com
NOTE : a.d@icppa.com
NOTE : X-Mailer : IceWarp Mailer 11.4.1.5 (2016-06-08) UBUNTU1404 x64
NOTE : Received : from antirelay02.smtp.cz (antirelay02.smtp.cz. [81.95.105.132])


NOTE : Received : from icppa.com [197.210.25.145] ([127.0.0.1])


NOTE : by iw01.smtp.cz (IceWarp 11.4.1.5 (2016-06-08)
NOTE : 81.95.105.132

CANADA PROVINCIAL NOMINATION PROGRAM

CANADA PROVINCIAL NOMINATION PROGRAM
1148 Hornby Street
Vancouver, BC
V6Z 2C3

Hello Nominee,

Canada Resettlement Provincial Nomination Programs

This is to congratulate you for being selected in Canada 2016 Resettlement Provincial Nomination Programs, you are among the list of persons that have been nominated for 2016 settlement to Canada with benefits from Canada Government, you and your family will be granted settlement with benefits if you can meet the basic requirements.

Your nomination code is (PNP-CAN001201411)

Every year certain numbers of people are selected via e-mail through our electronic ballot system for resettlement by Canadian Government as part of support to some Countries.

Please confirm receipt of this notification, by responding immediately. So that we can forward the relevant requirements.

Note: If you receive this notice repeatedly, it is to ensure it delivers safely into your mailbox without failure delivery due to network problem

For further details
Contact us.
Program Coordinator
Miss Deborah Woll
cic.pnp@consultant.com

FOR MORE DETAILS
PLEASE CONTACT US VIA
Emails- cic.pnp@consultant.com

----------------------------------------------------------------------------------------------------------------------
IMPORTANT LEGAL NOTICE: The information contained in this communication is confidential, may be client privileged, may constitute inside information, and is intended only for the use of the addressee. It is the property of CANADA IMMIGRATION & RESETTLEMENT BUREAU and the sender. Unauthorized use, disclosure or copying of this communication or any part thereof is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by return e-mail to cic.pnp.resettlement@post.com and destroy this communication and all copies thereof, including all attachments.
----------------------------------------------------------------------------------------------------------------------

Email analysis :

NOTE : cic.immigration.gc@gmx.com
NOTE : cic.pnp@consultant.com
NOTE : cic.pnp.resettlement@post.com
NOTE : User-Agent : Webmail INTN/0.8.2
NOTE : Organization : Canada Resettlement Provincial Nomination Programs
NOTE : Received : from mail.intn.gov.py (unknown [192.168.0.90])


NOTE : The server used to relay this scam was the "Instituto Nacional de Technologia, Normalizacion y Metrologia"

Hello Dear,


Hello Dear,

Greeting in the name of our lord jesus christ.i am mrs patricia cedillas,a widow to late timothy cedillas i am 48 year,s old. i am now a new christain convert,suffering from long time cancer of the lungs,from all indication my conditions is really deteriorating and it is quite obvious that i wont live more than 2 months,according to my doctors,this because the cancer stage has gotten to a very bad stage,my late husband was killed during u.s. raid against terrorism in afghanistan, and during the period of our marriage we could'nt produce any child. my late husband was very wealthy and after his death,i inherited all his business and wealth,the doctor has adviced me that i may not live more than two months,so i decided to devide the part of this wealth,to contribute to the development of church in africa,america,asia,and europe.

i saw your profile in web site and i prayed over it before contacting you,i am willing to donate the sum of $5,000.000.00.USD(FIVE MILLION UNITED STATE DOLLARS)to the less privileged.please i want you to note that this fund is lying in a security company and upon my instruction my attorney who is presently in cote divoire will file in an application for you,for the transfer of the money in your name,lastly i honestly pray that this money when transferd to you,will be sure for the said purpose,because i have come to find out that wealth acquisition without christ is vanity,may the grace of our lord jesus the love of God and the fellowship of God be with you and your family,

i await urgent reply.

your, in christ,mrs patricia cedillas

Email analysis :

NOTE : p9079c@yahoo.com
NOTE : patricia5cedillas@yahoo.com
NOTE : Received : from jws700024.mail.ir2.yahoo.com
NOTE : by sendmailws110.mail.ir2.yahoo.com

Investment Offer

Hello Dear,

I am obliged to open this vital business discussion with you for a possible investment partnership.

We have the capacity to provide direct business funding for large investment projects from the network of wealthy Arab Businessmen and also from the Royal Household Investment Group. Our investment capital for Europe and Asia is over USD$9 BILLION Dollars and we have the funds right there In Europe and Asia. We Have funds under management of Finance Companies in (1) Belgium(2) Holland (3) Canada (4) United States of America (USA) (5) Indonesia (6) Malaysia (7) Turkey. However, Before we provide the investment funds, We would like to submit our Memorandum of Understanding/Agreement and Terms for your consideration and endorsement.

Before that, We shall need the following information’s:

1- Telephone Numbers and Fax 404-900-2765
2- The investment Amount required. $100,000

Kindly acknowledge my email for further information on the MOU and Investment Terms.

Regards,
MR. TOBI THOMAS.
Reply Email: ( fcmtb@yahoo.com )
FIDELITY CAPITAL MANAGEMENT CORPORATION.
Website: https://www.fidelity.com/

Email analysis :

NOTE : adelsayed7777@outlook.com

Monday, November 21, 2016

GOOD NEWS


Your first payment of $5000.00 has been sent today via MONEY GRAM. You are advise to Contact M.G with your full information to enable them give you Sender Name, Question and Answer to pick up your First Payment Mtcn#3600-532-391, For more information contact Pastor. Fred Wilson, Tel:(+2295157950) Email:(w.w.w.moneygramfund@gmail.com) he'll keep sending you payment until your total fund is Completed

Email analysis :

NOTE : mrssusanleo@cantv.net
NOTE : w.w.w.moneygramfund@gmail.com
NOTE : Received : from 41.86.238.51 ([41.86.238.51])


NOTE : by webmail-02.datacenter.cha.cantv.net

CONGRATULATIONS YOU HAVE WON($1,200,000.00)DOLLARS !!!

AUSTRALIA LOTTO LOTTERY INC.
ELECTRONIC MAIL AWARD WINNING NOTIFICATION
AWARD PRESENTATION CENTER : AUSTRALIA

DATE: 21/11/2016
Ref: 575061725
Batch: 8056490902/188
Winning no: KB8701/LPRC

CONGRATULATIONS...............................

We are delighted to inform you of your prize release on the 21th November, 2016 from the Australian International Lottery programmer. Which is fully based on an electronic selection of winners using their e-mail addresses , your name was attached to ticket number 575061725 8056490902 serial number 6741137002 batch number 8056490902/188. This batch draws the lucky numbers as follows 4-13-33-37-42bonus number 17, which consequently won the lottery in the second category. You hereby have been approved a lump sum of US$1,200,000.00 (DOLLARS) in cash credit file ref ILP/HW 47509/02 from the total cash prize of US$9,600,000.00(NINE MILLION SIX HUNDRED THOUSAND DOLLARS) , shared among eight lucky winners in this category. All participants were selected through a computer balloting system drawn from Nine hundred thousand E-mail addresses from Canada , Australia , United state, Europe, Middle East, Africa and Oceania as part of our international promotions program which is conducted annually. This Lottery was promoted and sponsored by conglomerate of some multinational companies as part of their social responsibility to the citizens in the communities where they have operational base. We hope with part of your prize, you will participate in our end of year high stakes for US$1.3 Billion international draw. HOW TO CLAIM YOUR PRIZE, Simply contact Our fiduciary agent, NAME: MR.BARRISTER WILLIAMS MOORE EMAIL:barrwilliamssmoore@hotmail.com to file for your claim. Please quote your reference, batch and winning number which can be found on the top left corner of this notification as well as your full name, address and telephone number as to help us locate your file easily. For security reasons, we advice all winners to keep this information confidential from the public until your claim is processed and your prize released to you. This is part of our security protocol to avoid double claiming and unwarranted taking advantage of this of this programmer by non-participant or unofficial personnel. Note, all winnings MUST be claimed on or before 30 DAYS AFTER YOU HAVE RECEIVED YOU’RE WINNING INFORMATION. Otherwise all funds will be returned as Unclaimed and eventually donate to charity. Congratulations, once more from the entire Management and Staff of AUSTRALIA L.LOTTERY Cooperation to all our lucky winners this year. Thank you for being part of this promotional lottery program.

Yours Sincerely,
Mrs. LISA ADDISSON
(co-ordinator).

PLEASE DO NOT REPLY TO THIS EMAIL.CONTACT YOUR CLAIMS AGENT: barrwilliamssmoore@hotmail.com BREACH OF CONFIDENTIALITY ON THE PART OF THE WINNERS WILL RESULT TO DISQUALIFICATION.

THANKS:
MANAGEMENT, AUSTRALIA LOTTO LOTTERY INC.

Email analysis :

NOTE : bb0kim11@aol.com
NOTE : Received : from 41.190.3.163


NOTE : by webprd-a78.mail.aol.com (10.72.92.217)

High Quality Logo Design & Website For Your Business (OP)

Hello,

I am a freelance graphic designer and a website developer and I can get a very creative logo / brand identity / Business Card or Letterhead designed for your website / company at a very low price of $75 per logo. I will provide you with 4 different designs to choose from and then unlimited reasonable revisions for them until you are satisfied with any one of the design for your branding.

The final logo file will be high resolution vector format which you can be used for print / web as per your requirement. I will provide with a logo guide which you can use as a reference to provide more information about the logo you need. You can also place a logo design request through our online order form below or via email as well. Some sample designs are given below for your reference....

logo_new.png

In addition I also do website designing starting at $299 per website and write articles / content for your website at $10 per page of 500 words. Our SEO plans starts at $149 per month.

If you need hosting service, our plans start at $2.95 per month and should you want I can also arrange for references as well who can vouch that this is a genuine offer and not a spam. Should you want to see some more of my logo designs / website samples, please do ask for them. I assure you of quality work and do look forward to hearing from you.

Regards,
Veronika Taylor

Email analysis :

NOTE : veronika.taylor@servicesstuff.info
NOTE : richard.taylor@moderntechsols.co.in
NOTE : X-Remote : 31.192.111.152


NOTE : X-Php-Originating-Script : 0:email.php
NOTE : Received : from root by servicesstuff.info

Vacancy #627

Dear ***,

We are looking for employees working remotely.

My name is Twila, I am the personnel manager of a large International company.
Most of the work you can do from home, that is, at a distance.
Salary is $2500-$5500.

If you are interested in this offer, please visit Our Site

Have a nice day!

Email analysis :

NOTE : weixulu.comm@rutgers.edu


NOTE : Received : from 91.98.80.137.pol.ir (unknown [91.98.80.137])


Spam analysis :

CLICK : http://iken.in/subdomain/stjohnsamaritananandnagar/aspnet_client/system_web/2_0_50727/
REDIRECT : http://risebinarys.com/?u=pb7k605&o=3f6p2zp&t=del1
REDIRECT : http://risebinarys.com/web/
REDIRECT : http://profitformula4.com/?u=l5260



Domain analysis :

iken.in : Viren Patel / axiom education / Andheri E, MUmbai, maharashtra 400059 / +91.9833201820 / director@mexuseducation.com

risebinarys.com : 2ef3eaba63c4e1d8868a90978962b0c36eb1ff6c55161e3425d8d1d7b78d7cf8@risebinarys.com.whoisproxy.org

profitformula4.com : Whoisprotection.cc / adm_15244208@whoisprotection.cc

שלום יש לנו מאגרים גדולים של מיליוני כתובות אימייל, מפולחים לפי תחומים/קטגוריות, יש לנו אימיילים של חברות

שלום יש לנו מאגרים גדולים של מיליוני כתובות אימייל, מפולחים לפי תחומים/קטגוריות, יש לנו אימיילים של חברות, של עסקים, ושל אנשים פרטיים, האימיילים מפולחים, לפי מעמד כלכלי, לפי בעלי מקצוע/חברות, לפי גילאים, לפי מין, ולפי עוד המון פילוחים, אם אתם מעוניינים לקנות, תרשמו לנו איזה קטגוריות או פילוחים של אימיילים אתם מעוניינים לקנות

Hello we have large reserves of millions of email addresses, segmented by areas / categories, we have a corporate email

Hello we have large reserves of millions of email addresses, segmented by areas / categories, we have emails of companies, businesses, and individuals, emails are divided, according to economic status, by professionals / companies, by age, by gender, and by another a lot of breakdowns, if you want to buy, you write us some categories or breakdowns of emails you want to buy.

Email analysis :

NOTE : saleson92@walla.co.il
NOTE : Received : from mail-api55.walla.co.il (mail-api55.walla.co.il. [192.118.71.55])
NOTE : Mime-Version : 1.0
NOTE : client-ip=192.118.71.55;

Sunday, November 20, 2016

RE: Financial Reimbursement

Trusted Lenders
Accessible Loans
No Surprises
No Hidden Cost

100% LENDER APPROVAL. Personal loan,Business loan,Home purchase loans and 2nd mortgages awaiting Approval with nothing to pay until February, 2017. Contact Us

Please disregard this email if you do not need a loan. For inquiries and application, just drop us a message at; larrysimthloan@gmail.com

Thanks and God bless you.

Email analysis :

NOTE : larrysimthloan@gmail.com
NOTE : postmaster@zmail.ipm.ir
NOTE : Received : from [10.169.248.175] (unknown [41.113.114.58])


NOTE : by zmail.ipm.ir (Postfix)


NOTE : Received : from zmail.ipm.ir (test.ipm.ac.ir. [194.225.73.156])


NOTE : A scam was relayed using the Iranian Instute for Research in Fundamental Sciences.

INFORMATION ABOUT IPM :

The Institute for research in fundamental sciences (previously the Institute for Studies in Theoretical Physics and Mathematics, often shortened to IPM (Persian: پژوهشگاه دانشهای بنیادی‎‎)) is an advanced research institute founded in 1989 in Tehran, Iran. The institute was the first Iranian organization to connect to the Internet.


It is also the domain name registry of .ir domain names. The institute has four main campuses, all north of Tehran in the Farmanieh district, immediately south of Niavaran. It offers advanced PhD degrees in areas such as Mathematical Logic and Plasma Physics among others.

IPM is directed by Mohammad Javad Larijani, its original founder.

Mr. X

Good Day! I am the Head of Corporate Finance at Shawbrook Asset Finance, Ltd here in UK, I handle all investment bankers, private investment groups and private investor's direct capital funds. I do have a private authorization of one of my clients (Mr.) Talal Ben Yushah who is from Libya with delicate political position to seek for individuals with sound financial management experiences to handle the investment and management of over US$500 Million devoid of his name. If you have fund management abilities or credible projects in need of funding, please let us a have brief description of your nature of business/professional experiences alongside your registered business name and physical address in a returned email so we can discuss further. NOTE: This mutual partnership is 100% legal, risk Call me +44 7937025283 or reply to: park_john@financier.com/parkohn10@gmail.com I will explain further when you respond. I count on your understanding and I would appreciate your urgent response. Note if you are not wily to handle the transaction don't border to reply me this is very serious thank you. Sincerely, Mr. Park John

Email analysis :

NOTE : gw.skauto.co.kr
NOTE : olaridnaf01@gmail.com
NOTE : Received : from [41.71.176.74] ([41.71.176.74])


NOTE : by spam.skauto.co.kr ([117.52.98.41])

Vital Update is Required (Lloyds Phishing)

Security Alert

Your Lloyds Online access need to be upgraded to match the details we hold on record for you. Failure to upgrade means you will encounter problem logging on to your online profile next time. Thanks for your co-operation.

Please update and verify your information.

Get Started ?

Please note: Failure to restore full access can lead to permanent suspension of access to our online banking service.

Best regards,
Lloyds Online Banking Team
Legal Privacy Security www.lloydsbankinggroup.com Rates and Charges

Phishing analysis :

CLICK : Get Started ?
OPEN : www.schlosserei-moser.it/wp-content/plugins/Lloyds(1)/
RESULT : Unresponsive

Email analysis :

NOTE : id-@hltv.org
NOTE : Mime-Version : 1.0
NOTE : smtp.mailfrom=id-@hltv.org
NOTE : Received : from nataraya.thirdeye.it (nataraya.thirdeye.it. [185.19.185.34])
NOTE : Received : from rudra.thirdeye.it (rudra.thirdeye.it [185.19.184.135])
NOTE : by nataraya.thirdeye.it
NOTE : Received : by rudra.thirdeye.it (Postfix)
NOTE : Received : from rudra.thirdeye.it ([127.0.0.1])
NOTE : by localhost (rudra.thirdeye.it [127.0.0.1])
NOTE : Received : from Admin-PC (unknown [41.207.200.91])


NOTE : by rudra.thirdeye.it (Postfix)
NOTE : X-Thirdeye-Mailscanner-From : id-@hltv.org
NOTE : Vital Update is Required

Friday, November 18, 2016

*.* (Facebook Likes Scam)

Ciao,

Io vi contatterà dopo aver visitato la pagina *.* .

Siamo in grado di aumentare il numero di calibro sulla tua pagina, per migliorare la vostra immagine e la fiducia dei vostri ospiti o clienti. La maggior parte degli utenti di Internet si sentono più sicuri e avere un quadro più preciso di un sito che visualizza un gran numero di calibro sulla sua pagina. È possibile ordinare i fan pack Facebook a un prezzo speciale sul webmaster nostro sito. Non esitate a contattarci per richiedere ulteriori informazioni

Cordiali saluti,
Benedetto Barattino

Hello,

I will contact you after visiting the *.* page.

We can increase the number of likes on your page, to improve your image and confidence of your visitors or customers. The majority of Internet users feel more confident and have a more accurate picture of a site that displays a large number of likes on his page. You can sort your Facebook fans pack at a special price on our website webmaster. Do not hesitate to contact us for more information

Best regards,
Benedict Barattino

Email analysis :

NOTE : mail@fbmarketingf.us
NOTE : 178.170.83.252


FSA-ReN0GFI

FROM THE DESK OF LORD ADAIR TURNER,
Chairman, Financial Services Authority (FSA),
Direct Telephone:(44)7031952253

ATTEN: BENEFICIARY

Previously I have sent this notification which you are yet to respond. With reference to the recall of your funds, it has come to our notice via our central monitoring computer that a huge fund has been credited in your name for transfer with a London Bank. Under the stipulated enabling Law of the Government of Great Britain and Wales and other Commonwealth States, any huge fund that has been found in our computer system waiting to be transferred without claims for a period of 6 months or less, shall be confiscated and forfeited to the Government of Great Britain and Wales.

We do hereby ask you to contact this office immediately for ratification within 3 days of this notice or consider your fund confiscated.

We appreciate your urgent co-operation.

LORD ADAIR TURNER, CHAIRMAN,
FINANCIAL SERVICES AUTHORITY (FSA).
LONDON, UNITED KINGDOM

Email analysis :

NOTE : info@nevajans.com
NOTE : mgguzman@difnl.gob.mx
NOTE : Content-Type : text/plain; charset="iso-8859-1"
NOTE : Mime-Version : 1.0
NOTE : Received : from email.difnl.gob.mx (email.difnl.gob.mx. [189.213.106.19])


NOTE : Received : from [100.101.158.18] ([106.198.255.21])


NOTE : (authenticated bits=0) by email.difnl.gob.mx
NOTE : client-ip=189.213.106.19;


NOTE : Content-Description : Mail message body
NOTE : FSA-ReN0GFI

ATM

Your ATM CARD of USD2.5.is with us with registration code of (Shipment Code 11684990)contact us with your delivery information such as, Your Name, Your Address and Your Telephone Number:Contact:(kikioffice6@gmail.com)

Email analysis :

NOTE : kikioffice6@gmail.com
NOTE : x@x.com
NOTE : luisgonzalezjr@cantv.net
NOTE : Received : from 41.138.89.214 ([41.138.89.214])


NOTE : by webmail-02.datacenter.cha.cantv.net (Cantv Webmail) with HTTP;

I will not fail to compersate you

Hello My Dear Beloved I'm happy to inform you about my getting those funds transferred under the co operation of a new business partner from Paraguay. I'm in Paraguay for treatment and investment but meanwhile, I didn't forget your past efforts and attempts to assist me in transferring those funds despite that it failed us some how, but without the your last name I would have not gotten the fund so I have left your compensation fund in a VISA ATM Card with my Secretary in Benin Republic. contact my secretary in Benin his name is Mr Edwin Onuga Hounn, Email: (edwinonunga22@yahoo.com) Ask him to send you the VISA ATM Card containing the total of 800.000.00 Euro which I kept for your compensation for all your past efforts and attempts to assist me in this matter. I appreciated your efforts at that time very much. so get in touch with my secretary Mr Fre Houn and instruct him where to send the VISA ATM Card containing the total of 800.000.00 Euro to you without any delay, Remember that I had forwarded instruction to Him on your behalf. My Best Regards, Writing from Paraguay

Email analysis :

NOTE : Return-Path : < craig.car@outlook.com >
NOTE : 181.196.51.229 ()


NOTE : Mime-Version : 1.0
NOTE : amavisd-new at tena.gob.ec


NOTE : Received : from mail.tena.gob.ec ([127.0.0.1])
NOTE : by localhost (mail.tena.gob.ec [127.0.0.1])
NOTE : Received : from [141.105.71.26] (unknown [141.105.71.26])


NOTE : by mail.tena.gob.ec (Postfix)
NOTE : I will not fail to compersate you

Shipment Code awb 33xzs (Email leak)


I have registered your ATM CARD of $8.5 with DHL Courier Company with registration code of ( Shipment Code awb 33xzs,ATM Card Registered Code No xgt442.Security Code sctc/2001dhx/567/;Transaction Code 233/cstc/101/33028/;Certificate Deposit code; sctc/bun/xxiv/-78/01). please Contact with your delivery information such as, Your Name, Your Address and Your Telephone Number:Courier Office: DHL

Name of Dir:Dr.Clarck Robert,
E-mail:(mr.johndavidson@outlook.com)
Tel:+229-98643209

I have paid for the Insurance & Delivery fee.The only fee you have to pay is their Security fee only.Please indicate the registration Number and ask Him how much is their Security fee so that you can pay it.

Best Regards,
Mrs.Anne Dinma

Email leak :

vcorningstone78@gmail.com, m.litoris224@gmail.com, marjac.1993@gmail.com, marjac.1995@gmail.com, oldmichaelhunt@gmail.com, hughjarce333@gmail.com, acaster247@gmail.com, marja.c1993@gmail.com, marjac1995@gmail.com, miakriskoff@gmail.com, pschlacter400@gmail.com, jennatulls27@gmail.com, gbreezy820@gmail.com, dr.richard.poke@gmail.com, sperks548@gmail.com, rich.dude.swag@gmail.com, rob.karhu@gmail.com, cartoonherodude@gmail.com, reverendtomjones@gmail.com, whiter958@gmail.com, jw508328@gmail.com, meandcecilia@gmail.com, marjac1997@gmail.com, jessicapierce318@gmail.com, webinis123@gmail.com, cj96050@gmail.com, taylorhelen66@gmail.com, harrold.fiducious@gmail.com, bofasaur@gmail.com, lucy04anderson@gmail.com, rhejean16@gmail.com, cruise19allyson@gmail.com, cherrybree289@gmail.com, chelleanderson12@gmail.com, jasminedelancey@gmail.com, hector.rowles@gmail.com, hugoferreiracamargo@gmail.com, mizra9062@gmail.com, hugo35mm@gmail.com, gary.roaster@gmail.com, jennyblack7272@gmail.com, saveourunionflag@gmail.com, buraktorun7@gmail.com, np.eccomiqua@gmail.com, madgekz3bonner@gmail.com, robinsavage447@gmail.com, kenneth.turse@gmail.com, bigmann768@gmail.com, stvesmthson33@gmail.com, ahdrianmallari14@gmail.com, mr04248@gmail.com, sessavivi@gmail.com, zuckuss1212@gmail.com, irvinggoldstein5@gmail.com, yanyanwong2005@gmail.com, troyllovell@gmail.com, bobjjmcgrath@gmail.com, theleroymister@gmail.com, tfuhlery@gmail.com, langitz@gmail.com, louellaalmeida@gmail.com, pastormax7777@gmail.com, hannahsilverson62@gmail.com, tonyraabit@gmail.com, springtimejeremy@gmail.com, clwabbit@gmail.com, wallbounce@gmail.com, hballsich@gmail.com, catharinestrauss@gmail.com, arturosear@gmail.com, nakulannanthakumar97@gmail.com, john.heissenberg@gmail.com, garylongmont135@gmail.com, jtrackster87@gmail.com, robin211985@gmail.com, rad.lad1156@gmail.com, nicolelsmith82@gmail.com, johnliu8513@gmail.com, diderdaniels@gmail.com, eylamao@gmail.com, templargoldencircle@gmail.com, lhbbooks@gmail.com, alwaysbeagiver@gmail.com, julietlovesbobmarley@gmail.com, dhoffman813@gmail.com, e.olsen.nimbus@gmail.com, spamus.det@gmail.com, bigtamedwards@gmail.com, edgar.broughton@gmail.com, fatheramp@gmail.com, pastor.ramen@gmail.com, shonimuronga@gmail.com, kableerm@gmail.com, quickcat8899@gmail.com, candimun@gmail.com, paul.treece.associates@gmail.com, marjac1999@gmail.com, cbradiochatapp@gmail.com, mr.johndavidson@outlook.com

Email analysis :

NOTE : X-Matched-Lists : []
NOTE : Return-Path : < andreiniesta@cantv.net >
NOTE : X-Originating-Ip : [197.234.219.95]


NOTE : Mime-Version : 1.0
NOTE : X-Virus-Scanned : amavisd-new at cantv.net
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Mailer : Cantv Webmail
NOTE : Content-Type : text/plain; charset=UTF-8
NOTE : Received : from webmail-02.datacenter.cha.cantv.net (webmail-02.datacenter.cha.cantv.net [200.11.153.85])
NOTE : (authenticated bits=0) by 10ibl21ser04.datacenter.cha.cantv.net (8.14.3/8.14.3/3.0)
NOTE : Received : from 197.234.219.95 ([197.234.219.95]) by webmail-02.datacenter.cha.cantv.net
NOTE : (Cantv Webmail) with HTTP; Mon, 7 Nov 2016 05:47:37 -0400 (VET)
NOTE : Shipment Code awb 33xzs

RE: shipping done

We shipped your crap.
Here s the tracking invoice :
https://www.ups.com/?tracking_invoice=219371293129312& action=download

Let us know when it arrives.
Thanks

Phishing analysis :

CLICK : https://www.ups.com/?tracking_invoice=219371293129312& action=download
OPEN : http://invoice-portal.com/invoices/get.php?id=d2VibWFzdGVyQHJiY2FmZS5jb20=
RESULT : Download a file called : inv11172016.doc

File analysis :

ESET-NOD32 : VBA/Kryptik.T
F-Secure : Trojan:W97M/Nastjencro.A
Fortinet : WM/Agent.5110!tr
Kaspersky : HEUR:Trojan.Script.Agent.gen
McAfee : W97M/Dropper.cu
McAfee-GW-Edition : W97M/Dropper.cu
NANO-Antivirus : Trojan.Ole2.Vbs-heuristic.druvzi
Panda : O97M/Downloader 20161117
Qihoo-360 : virus.office.gen.75
Symantec : W97M.Downloader
TrendMicro : W2KM_HANCITOR.YYSXC
TrendMicro-HouseCall : W2KM_HANCITOR.YYSXC

inv11172016.doc is a virus.

Email analysis :

NOTE : Return-Path : < rm@restaurantcocotte.com >
NOTE : 162.252.121.130 ()
NOTE : Mime-Version : 1.0
NOTE : Content-Transfer-Encoding : 7bit
NOTE : X-Mailer : iPad Mail (11D169)
NOTE : Message-Id : < *@restaurantcocotte.com >
NOTE : Content-Type : text/html; charset="utf-8"
NOTE : Received : from unknown (HELO restaurantcocotte.com) (162.252.121.130)


NOTE : RE: shipping done

Thursday, November 17, 2016

Rép : Bonjour cher correspondant (e)

Bonjour Je réponds au nom de Carolle Marran je suis de nationalité française, Je suis Veuve. Ex Ambassadrice de la France près du Bénin, d'où j'ai servis Pendant 3 ans de 1994 a 1997. J'ai décidé de vous légués ma fortune. Une somme de $ 800.000 usd dans une banque du Bénin avec toute la modestie et la sincérité d'une donation. Toute ma famille a qui je pouvais léguer cette fortune est mort suite à un Crash aérienne Boeing 772 qui s'est explosé en 1989 dans le désert de Ténéré au Niger. Cette vol avait quitté Brazzaville via N’Djamena pour Paris Celui-ci avait été explosé par un attentat libyen (la jamayiriya). mon mari avec mes deux enfants ont perdu la vie lors de cette accident. Actuellement je souffre du cancer de siens et du diabète. J'aimerai faire don de cette somme a une personne responsable humble qui pourra m'aider a créé des centre d'aide aux enfants pauvres, démunis et orphelins et même pour les personnes en difficultés. Contactez-moi à mon adresse émail: carollemarran@outlook.com pour que je sois rassurée de votre bonne personnalité afin de vous mettre en contact avec ma Banque et mon notaire.

Mme Carolle Marran

Les phrases chocs :

  • Actuellement je souffre du cancer de siens et du diabète
  • J'ai décidé de vous légués ma fortune

Email analysis :

NOTE : carollemarran@outlook.com
NOTE : Mime-Version : 1.0
NOTE : X-Sensitivity : 3
NOTE : Return-Path : < amministrazione@lifecostruzioni.it >
NOTE : X-Xam3-Api-Version : V3(R2)
NOTE : Received : from lifecostruzioni.it ([62.149.158.90])


NOTE : client-ip=62.149.156.78;
NOTE : X-Senderip : 41.86.238.84


NOTE : amministrazione@lifecostruzioni.it
NOTE : Rép : Bonjour cher correspondant (e)

ACCESS YOUR FUND URGENT NOW !!! (BOA Phishing)

Good Day..

Please my Dear we are sorry for our delaying so far!!, you can now access your compensation of $10.5 million U.S Dollar which has been credited on online account, it was registered with your Email, so log in to access the fund online now, with your Email and its password to clarify that this Email that is used to set up your online bank account is still active and to help us verify the real beneficiary,for easy access to your fund online , click here Online Fund Status to start the process, remember you can only log in with your email address and its password because it was registered with your email, for recognition of the real beneficiary of the fund, Note; even if it the site doesn't log you in at the first attempt try continuously okay, it will log you in to access your fund online and get back to me once you transfer total amount into your Bank account thanks..

Thanks
God bless!

Online Fund Status

Await your reply
Mrs Sandra Sandra


Email analysis :

NOTE : customer.rbos@gmail.com
NOTE : < bergenoid@gmail.com >
NOTE : Mime-Version : 1.0
NOTE : Content-Type : multipart/alternative;
NOTE : ACCESS YOUR FUND URGENT NOW !!!

Phishing analysis :

CLICK : Online Fund Status
OPEN : http://bit.ly/2fp5j9R
REDIRECT : http://deregulatedfxsolous.top/ZW50OiAiXGUwNTEiOw0KfQ0KLmljb24tZ2xvYmFsOmJlZm9yZSB7DQoJY29udGVudDogI/
SCREENSHOT :
CLICK : Login Now!
RESULT : ERROR MESSAGE.