PCH Notification.

Your Email address Won: $1,000,000.00USD on the Publishers Clearance House Awards {PCHA}. Contact Mrs. Elizabeth Hanks on Email: elizabethhanks45@gmail.com for claim.

Email analysis :

NOTE : LPennock@madisoncollege.edu
NOTE : elizabethhanks45@gmail.com
NOTE : 160.152.9.125

NOTE : Thread-Topic : PCH Notification.

Did you get my message.

Did you get my message.

Email analysis :

NOTE : adriana@ciad.edu.mx
NOTE : 1955795550@qq.com
NOTE : Mime-Version : 1.0
NOTE : Content-Language : en-us
NOTE : Return-Path : < adriana@ciad.edu.mx >
NOTE : X-Mailer : Microsoft Outlook 16.0
NOTE : Received : from xsmtp11.mail2web.com
NOTE : (xsmtp31.mail2web.com. [168.144.250.234])
NOTE : Received : from [10.5.2.15] (helo=xmail05.myhosting.com)
NOTE : by xsmtp11.mail2web.com with esmtps
NOTE : Received : from unknown (HELO BarthaPC) (Authenticated-user:_adriana@ciad.edu.mx@[116.202.32.80])

NOTE : client-ip=168.144.250.234;

NOTE : smtp.mailfrom=adriana@ciad.edu.mx
NOTE : Did you get my message.

Notes from Scam.cz :

- account used to relay this scam is : adriana@ciad.edu.mx

ciad.edu.mx

Scammer's PC name is BarthaPC located in New Delhi.

Account Representative

Greetings

We viewed your profile & we are interested in you to be the company's Account Representative in your region.

Sherry Roland W.
Cheoy Lee Shipyards Ltd

Email analysis :

NOTE : SLROLAND@hacc.edu
NOTE : X-Originating-Ip : [172.16.4.84]
NOTE : Received : from hb-pxsv02v.ad.hacc.edu

NOTE : (hb-pxsv02v.ad.hacc.edu [172.16.4.35])

Informations from Scam.cz :

- hacc.edu was compromised
- SLROLAND account was used.

RE: Notification: Email Us On freelottosweepstakesuk@gmail.com

From: Robinson, Barbara
Sent: Sunday, March 06, 2016 8:16 AM
To: Robinson, Barbara
Subject: Notification: Email Us On freelottosweepstakesuk@gmail.com

Dear Recipient,

You have won One Million two hundred and twelve thousand USD ($1,212,000.00) in the freelotto sweepstakes award with your Winning Number 22 25 56 21 5 49 BONUS 84 with draw no. 163. For claims, Email us at freelottosweepstakesuk@gmail.com

Congratulations!
Regards;
O.D Kelly
Online Presenter

Email analysis :

NOTE : BRobinson@ncwc.edu
NOTE : freelottosweepstakesuk@gmail.com
NOTE : Received : from mail.ncwc.edu (ncwcrmtexch02.ncwc.edu. [66.76.208.171])

NOTE : client-ip=66.76.208.171;
NOTE : X-Originating-Ip : [41.190.3.220]

Informations from Scam.cz :

- ncwc.edu was compromised
- Barbara Robinson account was used.

loterie,

loterie,

El Gordo Award 9. / 01/2015 Gratulace Email práve vyhrál 150,000,00 Euro byl mezi vítezi mesíce vyhraná cástka Of 150,000,00 Euro.
Loterie Processing oddelení
eklamace Kontakt osoba Pan Anthony Oliver.
Reklamace udeluje Cenu kontaktní e-mail: mr.anthonyoliver01@gmail.com
Váš Vítezný Podrobnosti.

Ref Number: AZLKM / 077HY / 2015
Císlo šarže: XXB001-ESP / 22mA
Serial No: TUK / 1107/915
Ticket Number: 77QH / GY098-WYH1

S pozdravem,
Paní Veronica Davidson.

Email analysis :

NOTE : X-Ms-Tnef-Correlator :
NOTE : X-Received : by 10.180.92.199
NOTE : Return-Path : < Husseinj@hebron.edu >
NOTE : X-Ms-Has-Attach :
NOTE : Mime-Version : 1.0
NOTE : smtp.mail=Husseinj@hebron.edu
NOTE : Accept-Language : en-US
NOTE : Thread-Topic : loterie,
NOTE : Acceptlanguage : en-US
NOTE : Received-Spf : none () client-ip=93.184.9.9;
NOTE : Received : from mail-gateway.hebron.edu (mail.hebron.edu. [93.184.9.9])
NOTE : Received : from mail-gateway.hebron.edu ([192.168.168.6])
NOTE : by mail-gateway.hebron.edu ([192.168.168.6])
NOTE : loterie,

Attention Beneficiary

Based on our investigation of your payment, we want to find out if you're still alive or did you sign any deed of assignment with (Mrs. Grace Jackson.) to receive your fund,reply to us with:

Your Full Names..........
Your Home/Office Address............
Your Tel Phone And cell phone..........
Your Occupation..................
Your Age/Sex...............
The nearest Airport To Your Country A Copy Of Your
Identity................

This is because $10.5 Million has been approved in your favor for payment so get the above information to us fast and unfailingly today or your fund will be released to Mrs. Grace Jackson.

Best Regards,

MR TERRY HANK.
Phone Number :+2348094187375
Chairman, Investigation and Debt Settlement Committee

Email analysis :
==========================================
NOTE : Return-Path : < timlin@networklab.csie.ncu.edu.tw >
NOTE : Received : from networklab.csie.ncu.edu.tw (140.115.155.199)
NOTE : Received : from networklab.csie.ncu.edu.tw (localhost [127.0.0.1])
NOTE : by networklab.csie.ncu.edu.tw (Postfix)
NOTE : Received : from networklab.csie.ncu.edu.tw ([127.0.0.1])
NOTE : by networklab.csie.ncu.edu.tw (networklab.csie.ncu.edu.tw [127.0.0.1])

NOTE : Received : from User (unknown [37.203.214.87])

NOTE : (Authenticated sender: tsungyi)
NOTE : by networklab.csie.ncu.edu.tw (Postfix)
NOTE : X-Virus-Scanned : amavisd-new at networklab.csie.ncu.edu.tw
NOTE : Attention Beneficiary
==========================================

Conclusion :
==========================================
Scam sent from server networklab.csie.ncu.edu.tw :

Scam sent from User : tsungyi
Scam sent from IP : 37.203.214.87 (A) VVTV.CO.UK
==========================================

VVTV.CO.UK WHOIS :
==========================================
Domain name: vvtv.co.uk
Registrant: tanghuan
Registrant type: Unknown
Registrant's address:
lian jiang lu 21hao
dalian
Liaoning
120325
China
Data validation: Registrant contact details awaiting validation
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com [Tag = PDR-IN]
URL: http://www.publicdomainregistry.com
Relevant dates:
Registered on: 06-Aug-2013
Expiry date: 06-Aug-2014
Last updated: 06-Aug-2013
Registration status: Renewal required.
*** This registration has been SUSPENDED. ***
Name servers:
f1g1ns1.dnspod.net
f1g1ns2.dnspod.net
==========================================