Friday, January 22, 2016

Your Order Has Been Placed (iTunes Store Phishing)

Apple: Order Number: 103993128

iTunes Store
Dear

Thank you for buying the following product on 18/01/2016

Product Name: F1-Pilot Premium(R)
Order Number: 103993128
Receipt Date: 18/01/2016
Order total: 14.02 EUR.

We hope that our tools and solutions have improved the way you do business this year.

If you did not authorize this purchase, please proceed with "Cancellation Form"

Cancel this Purchase

Phishing analysis :

CLICK : Cancel this Purchase
OPEN : https://directcabcall.com/dcc/cron/Update/login/
REDIRECT : http://https.paypatl.com.leodimiranda.com/nl/webapps/mf2f/home


Email analysis :

NOTE : Return-Path : < voveriukas@jml-group.lt >
NOTE : X-Php-Script : jml-group.lt/wp-content/files_mf/send.php for 105.108.42.181


NOTE : Received : from mail.ledinis.lt (mail.ledinis.lt. [109.235.64.119])


NOTE : Your Order Has Been Placed

Conclusion :

- iTunes Store phishing turning to Paypal phishing.

Hijacked websites :

directcabcall.com : owner : DIRECTCABCALL.COM@domainsbyproxy.com
leodimiranda.com : owner Irene Perrin / +61.386242485 / contact@myprivateregistration.com
jml-group.lt : UAB "Interneto vizija" / hostmaster@iv.lt
jml-group.lt : ress website / account voveriukas
ledinis.lt : UAB "Interneto vizija" / hostmaster@iv.lt

Phisher's origin :


IP : 105.108.42.181
Provider : Telecom Algeria
Country : Algeria
Latitude : 28
Longitude : 3

FROM MR.JUAN RAMOZ

Espoz y Mina, 22, 28012
Madrid, Spain.
Tell: +34- 631-445-058
Email: juanramoz@email.com

Dear Sir,

My company is a financial management law firm based in Spain, and I am communicating with you to see if you can discuss with me on matters concerning Michael George, a housing estate business man in Spain for two decades and who left some deposited fund in a financial institution before his death.

Because of its nature, my investigation requires some privacy. You can contact me by phone or email for further information on Mr. Michael George, whom I believe from my investigations that you could be entitled to his fund.

I await your soonest response.

Best Regards
Juan Ramoz

Email analysis :

NOTE : juanramoz@email.com
NOTE : gold@kb99.com
NOTE : User-Agent : ASFN Webmail/0.8.4
NOTE : Received : from [127.0.0.1] (helo=webmail.kb99.com)
NOTE : by kb99.com with esmtp (Exim 4.80)

I'm Barrister Roland from Save Guard Company

Attention Dear Client,

I'm Barrister Roland from Save Guard Company
please this letter is confidential and I hope you will understand this
letter, I work with a Save Guard Company there's fund here in our Chamber, this fund belongs to one of our client who passed away 5 months ago but he didn't have next of kin to this fund and this fund has been in our security system since he passed away, this man was from Russia he was a very rich business man so I want to do business with you, I want you to stand as the next of kin of this man, this fund will be transferred to you as the next of kin of this man, I will be needing your info as follows,

Full name:
Date of Birth:
Address:
Country:
Gender:
Phone No:
Passport/ID number

this information will be use to fill in the next of kin form, if you like I can send the form for you to fill it yourself and send it back to me.
please if you are ready to do this with me do let me know I will send to you the next of kin agreement filled with your information , so the fund will be release to you, and when that happen we will divide this fund by 50% for you and 50% for me, the amount in total is $3,500,000.00 Us Dollars, Three Million five hundred thousand Us Dollars, please if you can do this business with me please do get back to me ASAP.

Kind Regard
Barrister Roland
Save Guard Company
_____________________________________________________________________________________________________________
Save Guard Company
This e-mail and/or any documents accompanying this transmission is intended for a specific individual(s) and the address(s) only, as well as a specific purpose, and may contain legally privileged or confidential information. Any unauthorized use, disclosure, dissemination or reproduction of this email or the documents is strictly prohibited. If you receive this transmission in error, please notify the sender immediately and return the original to the sender by regular mail or delete the original without printing or forwarding.

Email analysis :

NOTE : saveguardcompanyforyou@gmail.com

Central Bank of Nigeria (CBN)

Central Bank of Nigeria (CBN), Plot 33, Abubakar Tafawa Balewa C.B District, Abuja, F.C.T, Nigeria P.M.B. 0187, Garki Abuja. Nigeria Ref: ECO/IRD/TLX/03/10 Official Landline: +234-9099158512 Attention: Beneficiary, Re: instruction to credit your account with the sum of US$10,000,000.00 This is to notify you that your over due inheritance funds has been gazetted to be release to your bank account within 48hrs, via key telex transfer (KTT). Mean while, a woman came to my office this morning with an application for transfer of the fund into her account on your behalf, claiming to be your representative. Here are the information’s she submitted for the transfer of your fund Bank of America 6901 Northwest Expressway Oklahoma City, Oklahoma 73132 ABA Routing: 026009593 ACCT No: 003042656833 ACCT Name: FMS Investments Inc. Please, do re-confirm to this office, as a matter of urgency if this woman is truly from you as the federal finance dept or our bank / my office will not be held responsible for paying into the wrong account. The reserve bank governor, executive, board of directors and the senate committee for foreign over due Inheritance fund have approved and accredited our reputable bank with the office of the director, international remittance/ Director Foreign Affairs , to handle and transfer of all foreign inheritance funds this third quarter payment schedule of the year 2016. However, we shall proceed to issue all payments details to the said MRS. MARGARET GEORGE, if we do not hear from you within the next 4 working days from today, this fund will be transferred to the account of MRS. MARGARET GEORGE. Meanwhile, you are advice to get back to my office immediately with the requested details to enable us have your correct details to wire your fund. 1. Your full name:........................ 2. Your telephone numbers:................. 3. Your full home address:................. 4. Your Company address and position............. 5. Your Age and Sex............. This fund will be remitted into your bank account within 48hrs as soon as you confirm to this office that you did not send the above name to claim your fund on your behalf, make sure that you get back to us with your above requested information unless you are sure that you send MRS. MARGARET GEORGE to claim the fund on your behalf. Best Regards Mr. Godwin Emefiele International Operations Central Bank of Nigeria (CBN) Federal Republic of Nigeria godwinemefiele62@yandex.com

Email analysis :

NOTE : godwinemefiele62@yandex.com
NOTE : vs08148@vs08148.priorweb.be
NOTE : client-ip=62.182.61.190;
NOTE : Received : from vs08148.priorweb.be
NOTE : (190-61.182.62.static.priorweb.net. [62.182.61.190])

Joy

hello

it give me a great pleasure to write you after viewing your profile at (*) which really interest me to have communication with you,i will be very happy if you can write me through my email for easiest communication,i will be waiting to hear from you,have a blessed day.

joy.

Email analysis :

NOTE : joypeter02@outlook.com
NOTE : ucojima@yahoo.com