Tuesday, June 14, 2016

Automated Tax Refund Notification (HMRC Phishing)

If you can't see this message, view it in your browser.

HM Revenue & Customs

After the last calculations of your fiscal activity , we determined that you are aligible to receive a tax refund of 380.01 £.

To access your tax refund, please follow this link

NOTE: A refund can be delayed a variety of reasons , for exemple submitting invalid records or applying after deadline. Revenue and Tax Administrator

HM Revenue & Customs Tax Credit Office
PO Box 1970
L75 1WX.

Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.

Email screenshot :

Email analysis :

NOTE : bruce.stewart.agent@gov.uk
NOTE : X-Barracuda-Url :
NOTE : X-Barracuda-Connect : 173-12-155-133-northgulf.hfc.comcastbusiness.net
NOTE : []
NOTE : mailhost.towne.com
NOTE : X-Barracuda-Auth-User : besadmin
NOTE : X-Barracuda-Apparent-Source-Ip :

NOTE : client-ip=;

Phishing anaylsis :

CLICK : this link
OPEN : http://educacaoadistancia.blog.br/wp-includes/hmrc/
REDIRECT : http://educacaoadistancia.blog.br/wp-includes/hmrc/startapplication/?*

CLICK : Let Start
REDIRECT : http://educacaoadistancia.blog.br/wp-includes/hmrc/startapplication/indentify.php?ip=*

CLICK : Next

CLICK : Start Refund

SELECT : A bank...
CLICK : Next

CLICK : Continue

CLICK : Confirm Tax Refund

REDIRECT : https://www.gov.uk/government/organisations/hm-revenue-customs

I thought you might be interested in this link



We offer Loan to serious individual or an Organization with low interest rate of 3% PA and maximum with no credit check, Loan period of 10yrs with Option of Rollover up to 2yrs. Loan Amount ranges from $1,000 Minimum up to a maximum of $20 Million with World Class standard facilities to make sure the funds gets to you at ease. all our loans & procedures are approved and qualified by our fully experienced compliance team. Equity Zen financial service has become one of the largest independent loan companies. We have an excellent reputation for the provision of first class financial loan products with exceptional customer service. any interested applicant should contact us to this Email: equityzenfinancialservice@gmail.com

Application Form To Fill Below..

Date of Birth:.........................
Purpose for the loan:...................
Phone Number:...................
Loan amount needed:...........................
Monthly income / annual income:....................

Thank You.

David Rosen

Click here to read the article.

If you have trouble viewing the link, copy and paste the following link into your browser:


For more information on Protiviti, visit www.***.com.

Email leak :

calebshmidt13@gmail.com, neilrochford@mail.com, joncolbert62@yahoo.com, fracisb99@gmail.com, red3ds@hotmail.co.uk, abankwater@gmail.com, Ivorstiffun40@gmail.com, peter.larinzsky@mail.com, sanfran_4one9ersfan@yahoo.com, gregory138@outlook.com, elliotcaddy@yahoo.com, barb@excelquest.com, james.sullivan.sykes@gmail.com, craig.dole75@gmail.com, Williamjames@gmx.co.uk, john.smith431221@gmail.com, kevin.pesci.business@gmail.com, scottstorch1@gmail.com, christunstall113@yahoo.com, rngmusick@gmail.com, azzkikkr9000@gmail.com, adz2000sg@gmail.com, jonathanwalker121@gmail.com, martinmcpherson1980@gmail.com, johanna@dollsdancers.fi, jbankwater@gmail.com, andreym56@rothga.com, barrykrunt@gmail.com, cathymullernyc@gmail.com, obrawkins.nathan@gmail.com, christian.lemon@gmx.com, smatz97@gmail.com, Bradymartha55@gmail.com, laja602@outlook.com, booptittybopbop2@gmail.com, ted.sergeant@outlook.com, danielandersonprivate@gmail.com, justcallmeminty@gmail.com, chansenchristine@openmailbox.org, jessie_1186@outlook.com, everyrosehasitsthorn56@gmail.com, kohlmansean@gmail.com, oliverjohnson1979@gmail.com, gabrieler.wall@mail.com, fiets@lunitje.nl, calvinghaggerty@gmail.com, jpistmobank@gmail.com, noradam1@gmx.com, oli.dugmore@gmail.com, clalande1754@gmail.com, trip.jensen@gmail.com, hotsoolahx@yahoo.com, lewis.wake@hotmail.com, Capricehaywood@yahoo.con, thehumanfundfoundation@gmail.com, phyllisf2@comcast.net, benhess777@gmail.com, tellytubbins@gmail.com, michaelkoxlong@hotmail.com, info@waterfrontbarton.co.uk, hydrolichotdog@gmail.com, WilkesHenry@mail.com, josh.lyman432@gmail.com, info@regalcredit.org.uk, stan.bowers@techmarketproviders.com, danyelthefallen@yahoo.com, wilfred.martinson@yahoo.com, chuckaspeer2@gmail.com, melissastuder91@outlook.com, Dumaseura@gmail.com, alexhendrik00@hotmail.com, bgrompton@gmail.com, carlosmalaga2014@gmail.com, Ledbetter.antonio@yahoo.com, aaronthreepwood@gmail.com, david.mirren@gmail.com, sebastianhsh@live.com, rwdawson75@gmail.com, dionspencer230@gmail.com, iainjones2015@gmail.com, Ravensblackrevenge@gmail.com, ferdinand.gash@gmail.com, galtaureus3@gmail.com, bob.grimley1968@gmx.com, marek.folkos@seznam.cz, jonthorton1@gmail.com, rainman9292@gmail.com, vladeemervladimirovich@outlook.com, oliver.queen@dutchmail.com, dos.perros@gmail.com, timmywest88@gmail.com, drjack.johnson@yahoo.com, ericforman67@gmail.com, Amiller12@mail.com, bf.kurtons@gmail.com, jlinker29@outlook.com, lize.daily@gmail.com, mzeegen@outlook.com, gussyginny@gmail.com

Email analysis :

NOTE : equityzenfinancialservice@gmail.com
NOTE : client-ip=;


I,m Jeh Charles. Johnson. The secretary of the U.S Department of Homeland security Washington DC. Office Address: 3801 Nebraska Ave NW, Washington, DC 20016, United States. We received a report from ECOWAS that you have an abandoned fund worth $4.5 Million in West Africa. I have instructed ECOWAS and the concerned authorities to bring the consignment box to our Head office in Washington DC. the fund will arrive my office today. I want you to kindly Reconfirm Your Full Name, Current Home Address, Nearest Airport and your Direct Cell Phone # So that arrangement can be made for the delivery of the consignment to your home address. I can be reached at (213)295-1439

I wait to hear from you.

Honorable Jeh C. Johnson
The secretary of
the U.S Department of
Homeland security
Washington DC
Office Address:
3801 Nebraska Ave NW,
Washington, DC 20016,
United States.

Email analysis :

NOTE : www.@grace.ocn.ne.jp
NOTE : jehcharles007@gmail.com
NOTE : X-Originating-Ip : []

NOTE : Received : from mf-smf-ucb003.ocn.ad.jp
NOTE : Received : from mzcstore422.ocn.ad.jp
NOTE : client-ip=;

NOTE : Content-Transfer-Encoding : 7bit

United Nations ATM Card Settlement This Season.

Attention: Beneficiary,

We have been having series of meetings for the passed 1 month now which ended 2 days ago with the Nigeria Government, and the former Secretary-General (Hon. Kofi Annan) to the UNITED NATIONS. Federal Reserve Bank of New York, HSBC Bank of United Kingdom (UK) with the World Bank Officials. This email is for all the people that have not been paid, for their contract/inheritance in any part of the world, the United Nations, Federal Reserve Bank of New York HSBC Bank of United Kingdom (UK) Reserve Bank of Nigeria, with the World Bank officials have agreed to compensate them with the sum of Four Million, Nine Hundred Thousand US Dollars each victim. This includes every foreign contractor that may have not received his or her contract sum and people that have had an unfinished transaction, people who have inheritance to claim or international businesses that failed due to instability of government in some part of World. We found your email address in our list and that is why we are contacting you, these have been agreed upon and have been duly signed.Therefore, we are happy to inform you that your ATM Card Number: 4120 5350 0015 has been approved and upgraded, via ZENITH BANK INT'L in your favor.Meanwhile, your Secret Pin Number will be available as soon as you confirm to us the receipt of your ATM CARD. The ATM Card Value is $6,300,000.00 USD Only. You are advised that a maximum withdrawal value of US$20,000.00 is permitted daily.And its is duly inter-switched and you can make withdrawal in any location of the ATM Center of your choice/nearest to you any where in the world. We have also concluded delivery arrangement with our accredited courier service Company DHL or Fedex to deliver your package to your door step. Be informed that your response would be by telephone or through email Only.Any further delay will be the pleasure of the UNRC to use your fund to help the people who have been displaced in Darfur, Sudan Africa which you can see it in this site http://www.savedarfur.org/ and the Tsunami's victims in Asia. So you are hereby advice to forward to this office Director ATM SWIFT CARD Department Therefore, you should send him your full Name and telephone number/your correct mailing address where you want him to send the ATM to you. Contact Person Apostle Robert Gate immediately for yourATM SWIFT CARD:

Person to Contact Apostle Rolland Eze E-mail: { fundscompenssation@qq.com } We are working according to the constitution binding this committee as well as helping the less privilege through this means. You will be required to contact the above mentioned institution via telephone or email. Hoping to hear from you as soon as you receive your ATM card.

1.YOUR FULL NAME ................
2.PHONE AND FAX NUMBER...............
4.A Copy Of Your Identity Attached To e-mail

Best Regards,

Mr. Ban-Ki Moon

Email analysis :

NOTE : United Nations ATM Card Settlement This Season.
NOTE : appostles-rolland@mail.com
NOTE : fundscompenssation@qq.com
NOTE : ()
NOTE : Received : from unknown (HELO ps-1c.ru) (

no reply (Phishing Crédit Agricole)

Cher(e) abonné(e),

Cet email a été envoyé par l'équipe Crédit Agricole pour vous informer que nous n'avons pas pu traiter votre paiement de facture.

Ceci pourrait être du a l'une ou l'autre des raisons suivantes:

1.Un changement récent de vos informations personnelles. (par exemple : adresse de facturation, téléphone..)

2. Soumission d'informations incorrecte pendant le processus de paiement de facture.

Pour s'assurer que votre service ne soit pas interrompu, nous avons invitons à confirmer et à mettre à jour toutes vos informations de facturation en cliquant ici:


Votre Service Clients reste à votre écoute 24h/24h, 7J/7.


Email analysis :

NOTE : no-reply@rdp.fr
NOTE : webmaster@web.pharmalink.cz
NOTE : X-Php-Originating-Script : 33:admin.php
NOTE : Received : by ispc03.suptech.cz (Postfix, from userid 33)

Phishing analysis :

OPEN : http://www.lacurvadeibaci.it/a/Agricole
RESULT : Phishing is unresponsive

Lt Selina Nitra

Hi dear,

you are very nice

I wish i could get to know you for it is my pleasure to have you as my friend for a friend is all about Respect,,,Admiration,contentious and affectionante also friendship is consist of sharing of ideas and showing true affection without cheats,,,lies and betray so can you welcome me, lets get to the ocean of love ?????????????

I am Lt Selina Nitra by name

Email analysis :

NOTE : ltseliinarespect@hotmail.com
NOTE : client-ip=;

NOTE : Mime-Version : 1.0
NOTE : Received : from jws11193.mail.ir2.yahoo.com
NOTE : by sendmailws168.mail.ir2.yahoo.com

Découvrez le pack PASS. (Phishing Société Générale)

Cliquez-ici pour activer ce service

Si vous ne voulez plus recevoir ce message automatique, connectez-vous à votre espace employeur et modifiez l'option de rappel de déclaration dans la rubrique

Email screenshot :

Email analysis :

NOTE : "SOCIETER GENERALE"@urbanpoint.com
NOTE : Content-Type : text/html; charset=iso-8859-1
NOTE : Mime-Version : 1.0
NOTE : Return-Path : < infox@urbanpoint.com >
NOTE : Received : from urbanpoint.com ([])
NOTE : Received : by urbanpoint.com
NOTE : X-Php-Originating-Script : 0:xroot.php
NOTE : Message-Id : < *.*@urbanpoint.com >
NOTE : Découvrez le pack PASS.

Phishing analysis :

CLICK : Cliquez-ici pour activer ce service
OPEN : http://www.sanjarfurniture.in/.Signet
RESULT : Phishing was unresponsive. Phishing attempt.

Attention Beneficiary (Moneygram Scam)

ADDRESS: 2225 Osborne Rd, St Marys, GA 31558,, United States.
Hours: OFFICE TEL: (409)3312943) for Call and Text SMS..

Attention Beneficiary !!!!!

The International Monetary Fund Annual Compensation from USA . The International Monetary Fund (IMF) is compensating some 2015 scam victims and your email address was found in the scam victims list. This MoneyGram®office has been mandated by the IMF to transfer your compensation to you via MoneyGram® Money Transfer in USA. However, we have concluded to effect your own payment through MoneyGram® Money Transfer, $2,999USD pay Day until the total sum of $1.5Million is completely transferred to you the receiver. We can't be able to wait or to send the payment with your email address alone instead, we hereby need your information to where we will be sending the funds. You Can Text us and fill below Information Or contact us via email.

(Receivers name)............
(Country)...................... .
( Address)...................... ..........
(Direct Mobile Phone Number).....................
(Your Age........................... .......
(ID copy)............. ..................

Note that your payment files will be returned to the IMF within 2hours if we did not hear from you because this was the instruction given to us by the IMF office here in Georgia, USA. We will start the transfer as soon as we receive your information. You are hereby warned not to communicate or duplicate this message for any reason what so ever because the US FBI is already on trace of the criminals from Africa.


Mr.david johnson.
Money Gram Money Transfer Office.
Address: 2225 Osborne Rd, St Marys, GA 31558,, United States.
Hours: Open today · 8:00 am – 8:00 pm
OFFICE TEL: (409)3312943) for Call and Text SMS.

Email analysis :

NOTE : www.@eos.ocn.ne.jp
NOTE : ubamoneygram48@yahoo.com
NOTE : X-Originating-Ip : []

NOTE : X-Remote : (mbkd0338.ocn.ad.jp)