Tuesday, August 8, 2017

FWD:RE (Phishing Société Générale)

Decouvrez Le Pass Securite

Afin de prevenir l'utilisation frauduleuse des cartes bancaire sur Internet, Societe Generale est dotee d'un dispositif de controle des paiements. Ce service est entierement gratuit

Notre systeme a detecte que vous n'avez pas active Pass securite

Cliquez ici Pour activez ce service

NOUVEAU: Votre identifiant evolue
NOTE : Ne pas repondre a ce courrier electronique car il est emis
automatiquement depuis une adresse technique

Cordialement
Alexandre krivine
Directeur de la relation clients

Merci pour choisire SOCIETE GENERALE!

Copyright ©2017 Societe Generale. Tous droits réservés.
Numéro d'immatriculation FSASociete Generale: 226056.

Apply Now >

Facebook
Twitter
Instagram
RSS
Appstore
Android

This message was sent to ilyass-maradona@live.fr
If you would like to update your email address, please click here.

To unsubscribe from emails, please log in to your Mint account
where you can manage your email and mobile alerts setting.

©2007—2017 Mint Software, Inc. | All Rights Reserved.
Mint.com 2632 Marine Way, Mountain View, CA 94043
Privacy Policy | Terms and Conditions

Phishing screenshot :


Email analysis :

NOTE : ing22@telus.net
NOTE : ilyass-maradona@live.fr
NOTE : Received : from cmta16.telus.net ([209.171.16.89])
NOTE : Received : from mtlp000023.email.telus.net ([172.20.100.250])
NOTE : by cmsmtp with SMTP
NOTE : X-Originating-Ip : [105.149.30.122]


Phishing anaylsis :

CLICK : Cliquez ici Pour activez ce service
OPEN : http://www.goingesten.se/wp-snapshots/tmp/
REDIRECT : http://se.nickelmountain.se/wp-includes/theme/9f24e/Action.php?*
SCREENSHOT :


CLICK : VALIDATE WRONG CODE
REDIRECT : http://se.nickelmountain.se/wp-includes/theme/9f24e/dcr-web/
SCREENSHOT :


VALIDATE : FORM
REDIRECT : http://se.nickelmountain.se/wp-includes/theme/9f24e/dcr-web/deconnecter.php?date=0000000000&crd=0000&date-ex=00&year-ex=0000&cv=000&numo=0000000000&zob1=00000000&zob2=000000
REDIRECT : http://societegenerale.fr/

Saturday, May 13, 2017

Need mnoey?Eaarn 50.000 per moonth.

###MAKE MONEY ON1|NE###
===EAARN 50.000 PER MONNTH===
1.You need 0nly email to regisster
2.Fluly automattic sytsem!NOTHING TO DO...
3.@bs0lutely passvie inc0me
http://www.wildstonesolution.com/wp-content/plugins/wordpress-seo/vendor/xrstf/composer-php52/lib/5bc10d79da.html

The title of the scam can also be : Need mooney?Eran 50.000 per moonth. with a different content

###MAAKE MONNEY ONLLNE###
===EAARN 50.000 PER MONTH===
1.You neeed only emmail to reg|$ter
2.Fuliy automatic ssytem!NOTHING TO DO...
3.Absolute1y passive lnc0me
http://www.ieee-papers.com/wp-content/themes/twentyseventeen/2159b211e2.html

Email analysis :

NOTE : mhurdsj@excite.it
NOTE : gfgrimaud@tjb-barre.com
NOTE : 202.150.50.14


NOTE : 113.186.177.167


Phishing analysis :

CLICK : http://www.wildstonesolution.com/wp-content/plugins/wordpress-seo/vendor/xrstf/composer-php52/lib/5bc10d79da.html
Result : Redirect to Google, the phishing was removed...

CLICK : http://www.ieee-papers.com/wp-content/themes/twentyseventeen/2159b211e2.html
RESULT : Redirect to Google, the phishing was removed

NOTE : Two wordpress websites were compromised to do this phishing.

Tuesday, November 29, 2016

New incoming Fax from 908.8325722

You Have a new Fax message
From: 908.8145483
Receiving date: November 28, 2016
Pages: 3

You can view your message on our website:
https://service.ringcentral.com/ messages/download.aspx?fax_id=1805802

Thank you for using RingCentral.

Link analysis :

CLICK : https://service.ringcentral.com/ messages/download.aspx?fax_id=1805802
OPEN : http://787.vn/wp-content/themes/tourpackage-v1-02/backup/get.php?id=dGVzdEB0ZXN0LmNvbQ==
DOWNLOAD : fax_test.doc

File analysis :


OPEN : fax_test.doc
SHA256 : c0b3934b594a23dd88a42c0e96ccbbf7f88c633a19d82833d6d9bbf47630a0c1
RESULT : fax_test.doc is a virus

Virus analysis :

Avast : VBA:Downloader-DSL [Trj]
ClamAV : Doc.Dropper.Agent-1847249
Kaspersky : Trojan-Downloader.MSWord.Agent.avj
Qihoo-360 : virus.office.gen.70
Sophos : Troj/DocDl-FTZ
Symantec : W97M.Downloader

Email analysis :

NOTE : ringcentral@faxmessage.com
NOTE : 74.143.65.242 (rrcs-74-143-65-242.central.biz.rr.com)


NOTE : Mime-Version : 1.0

Thursday, October 13, 2016

Email Account Re-activation (Move To Inbox) (Phishing)

Dear User prout@prout.com

We noticed that your email account has been outdated . Your prout@prout.com account has been placed on temporary block, it would be permanently blocked if you do not unblock within 48hours.

Click here to unblock your account

Note:

Failure to unblock your e-mail account. It will be permanently disabled.

Thank you for using our service.

Phishing analyis :

CLICK : Click here to unblock your account
OPEN : http://parijatpackaging.com/wp-content/Auth//aut.php?email=prout@prout.com
SCREENSHOT :


CLICK : Submit Now
REDIRECT : http://parijatpackaging.com/wp-content/Auth//success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
SCREENSHOT :


Email analysis :

NOTE : kbeneteau@tmmsinc.com
NOTE : Mime-Version : 1.0
NOTE : Remote : 124.24.62.192 (pcweb03.mcdonalds.co.jp)
NOTE : Return-Path : < kbeneteau@tmmsinc.com >
NOTE : Received : from pcweb03.mcdonalds.co.jp (HELO pcweb03.www.mcdonalds.co.jp) (124.24.62.192)


NOTE : Received : from Server-PC.LangBak.local (unknown [10.73.24.16])
NOTE : by pcweb03.www.mcdonalds.co.jp (Postfix)
NOTE : Email Account Re-activation (Move To Inbox)

Sunday, December 27, 2015

Ahoj, (Scam)

Ahoj, Jak se dnes máš? Jsem Renee Torres, 16 let od Wooster ve státě Ohio Spojených států amerických. Byl jsem vychován na jedinou matkou, která zemřela před několika lety. Než zemřela ona odkázala její vlastnosti oceňují 3,9 milionů dolarů dolarů, aby mě jako její jediná dcera, ale můj nevlastní otec, který má problémy s drogami a alkoholem se zabývá léčbou mě velmi špatné, a hrozí, že mě zabije, jestli se mi nelíbí předání vlastnosti dokumentů k němu , Musím žít tento dům co nejdříve, vše co potřebujete, je strážce, který bude stát, abych se tvrdit, své dědictví, protože nemám jiné přežívající člena rodiny běžet do. Prosím, pomozte mi a já budu navždy zůstane vděčný, budu vysvětlovat dál, když slyším od vás Přiložený je můj obrázek, abyste věděli, jak vypadám Doufám, že slyším od vás brzy Pozdravy, Miss Renee Torres.

Email analysis :

NOTE : reneetow96@gmail.com
NOTE : Received : from tri.tribomidia.com.br
NOTE : (tri.tribomidia.com.br. [192.163.199.37])
NOTE : avn.org.br/wp-includes/css/YellowMailer.php for 105.189.58.137

Tuesday, October 27, 2015

We were unable to process your most recent payment... (Amazon Phishing)

Amazon.com

Today's Deals See All Departments

= = = = = = = = = = = = = = = = = = = =

We were unable to process your most recent payment. Did you recently change your bank, phone number or credit card?. To ensure that your service is not interrupted, please update your billing information today.

Confirm your account now

We're available 24 hours a day, 7 days a week. If you have recently updated your billing information, please disregard this message as we are processing the changes you have made. If you need further assistance with your order.

= = = = = = = = = = = = = = = = = = = =

Amazon.com
Connect with us

Phishing analysis :

CLICK : Confirm your account now
OPEN : http://www.intellectualjourneyofenlightenment.org/admin/css/amazon.com-verification/id/
RESULT : This Account Has Been Suspended

intellectualjourneyofenlightenment.org whois :

Registrant ID:DI_41908394
Registrant Name:Atul Kumar Jain
Registrant Organization:intellectualjourneyofenlightenment.org
Registrant Street: 363, sec 15
Registrant City:Panchkula
Registrant State/Province:Haryana
Registrant Postal Code:134114
Registrant Country:IN
Registrant Phone:+91.9888054461
Registrant Email:atul.jain2711@gmail.com
Admin ID:DI_41908394

Email analysis :

NOTE : noreply@amzon.support82.e-i.com
NOTE : 192.163.247.190 (ami.amiableargument.com)
NOTE : X-Source-Args : /usr/bin/php /home/wwwtheiv/public_html/clientscript/ie7/wp-confiiig.php
NOTE : Received : from wwwtheiv by ami.amiableargument.com
NOTE : (envelope-from < wwwtheiv@ami.amiableargument.com >)
NOTE : X-Mailer : theivoryquill.com
NOTE : X-Php-Script : theivoryquill.com/clientscript/ie7/wp-confiiig.php
NOTE : for 185.109.161.21


NOTE : X-Get-Message-Sender-Via : ami.amiableargument.com:
NOTE : authenticated_id: wwwtheiv/only
NOTE : user confirmed/virtual account not confirmed

Tuesday, June 9, 2015

Wordpress Spam Vol 1

sydney removals
***
neville.trout@gmail.com
66.131.108.43

Thanks for the marvelous posting! I genuinely enjoyed reading it, you’re a great author. I will make certain to bookmark your blog and will come back down the road. I want to encourage yourself to continue your great writing, have a nice evening!

ONEHalinapp
***
thorstenbinney@gmail.com
39.158.132.42

I see your website’s ranking is very low, it’s hard to find in search results. You would triple your traffic if you rank your website to top ten results. SEO become very hard nowadays, i know what can help you, just search in google for: Cerny’s tips outsource the work

seo plugin
***
jqbjnam@gmail.com
23.95.245.189

Hello Web Admin, I noticed that your On-Page SEO is is missing a few factors, for one you do not use all three H tags in your post, also I notice that you are not using bold or italics properly in your SEO optimization. On-Page SEO means more now than ever since the new Google update: Panda. No longer are backlinks and simply pinging or sending out a RSS feed the key to getting Google PageRank or Alexa Rankings, You now NEED On-Page SEO. So what is good On-Page SEO?First your keyword must appear in the title.Then it must appear in the URL.You have to optimize your keyword and make sure that it has a nice keyword density of 3-5% in your article with relevant LSI (Latent Semantic Indexing). Then you should spread all H1,H2,H3 tags in your article.Your Keyword should appear in your first paragraph and in the last sentence of the page. You should have relevant usage of Bold and italics of your keyword.There should be one internal link to a page on your blog and you should have one image with an alt tag that has your keyword….wait there’s even more Now what if i told you there was a simple WordPress plugin that does all the On-Page SEO, and automatically for you? That’s right AUTOMATICALLY, just watch this 4minute video for more information at. Seo Plugin

pokemon game
***
michaelwittenoom@gmail.com
138.128.2.241

I ԝas suggested this website by mƴ cousin. Ι am not sսre whethеr tҺis post is wгitten by ɦim as nobߋdy else know ѕuch detailed aƅout my trouble. Yоu arе amazing! Thɑnks!

seo
***
uedrljsbc@gmail.com
23.94.145.183

Hello Web Admin, I noticed that your On-Page SEO is is missing a few factors, for one you do not use all three H tags in your post, also I notice that you are not using bold or italics properly in your SEO optimization. On-Page SEO means more now than ever since the new Google update: Panda. No longer are backlinks and simply pinging or sending out a RSS feed the key to getting Google PageRank or Alexa Rankings, You now NEED On-Page SEO. So what is good On-Page SEO?First your keyword must appear in the title.Then it must appear in the URL.You have to optimize your keyword and make sure that it has a nice keyword density of 3-5% in your article with relevant LSI (Latent Semantic Indexing). Then you should spread all H1,H2,H3 tags in your article.Your Keyword should appear in your first paragraph and in the last sentence of the page. You should have relevant usage of Bold and italics of your keyword.There should be one internal link to a page on your blog and you should have one image with an alt tag that has your keyword….wait there’s even more Now what if i told you there was a simple WordPress plugin that does all the On-Page SEO, and automatically for you? That’s right AUTOMATICALLY, just watch this 4minute video for more information at. Seo Plugin

bbeyLangton
***
andersonfurnell@gawab.com
54.194.61.113

Hi admin, i see your website needs fresh content. Daily updates will rank your page in google higher, content is king nowadays. If you are to lazy to write unique posts everyday you should search in google for: Ightsero’s Essential Tool

JohnEndok
***
nrwghxow@gmail.com
37.57.231.112

Hi. And bye! John googoozuza Hi. And bye! John Hi. And bye! John googoozuza

MichaelEr
***
ms_sophia_taylor@outlook.com
46.119.112.121

Hi, *** admin how about finally earning $1500-$2500/day without lifting a finger? If making money online COULD be as easy as writing your own check… This might be it. *** 3 minutes into the video? Yep. That’s a $10000-$15000/week, right there. … All made with virtually no effort. Watch it and see for yourself. Download and copy exact system for yourself here: *** Your old friend Sophia

Delphine
***
xkyxpwcts@hotmail.co.uk
exvdnq@hotmail.co.uk
23.94.181.74
104.168.50.13

Hi, my name is Delphine and I am the sales manager at SwingSEO Solutions. I was just looking at your Whois – *** site and see that your site has the potential to become very popular. I just want to tell you, In case you don’t already know… There is a website network which already has more than 16 million users, and most of the users are interested in niches like yours. By getting your site on this service you have a chance to get your site more visitors than you can imagine. It is free to sign up and you can read more about it here: *** – Now, let me ask you… Do you need your website to be successful to maintain your business? Do you need targeted traffic who are interested in the services and products you offer? Are looking for exposure, to increase sales, and to quickly develop awareness for your website? If your answer is YES, you can achieve these things only if you get your website on the service I am describing. This traffic service advertises you to thousands, while also giving you a chance to test the network before paying anything. All the popular websites are using this network to boost their readership and ad revenue! Why aren’t you? And what is better than traffic? It’s recurring traffic! That’s how running a successful site works… Here’s to your success! Read more here: http://s.marcusmo.co.uk/5ot – or to unsubscribe please go here: ***

ShaynaBrookma
***
cheriloveless@bigstring.com
202.102.22.182

I noticed your page’s ranking in google’s search results is very low. You are loosing a lot of traffic. You need high authority backlinks to rank in top ten. I know – buying them is too expensive. It’s better to own them. I know how to do that, simply google it: Polswor’s Backlinks Source

fb86
***
fb86@hotmail.com
198.11.172.93

MohamedHalf
***
gastonmerrell@web.de
120.89.88.194

I see your page’s ranking is very low, it’s hard to find in search results. You would double your traffic if you rank your website to top ten results. SEO become very hard nowadays, i know what can help you, simply search in google for: Kelustu’s Tips Outsource The Work

tinggi
***
jestinekindler@arcor.de
87.92.27.115

Saved as a favorite, I like your blog!

wünschen
***
wallaceschuler@petml.com
95.88.42.255

Thanks in support of sharing such a pleasant idea, piece of writing is pleasant, thats why i have read it fully

wyglądają
***
byrontidwell@web.de
88.245.189.252

Have you ever considered writing an e-book or guest authoring on other sites? I have a blog centered on the same ideas you discuss and would really like to have you share some stories/information. I know my viewers would appreciate your work. If you are even remotely interested, feel free to send me an e mail.

collègue
***
jeanneoden@gmail.com
90.236.147.60

It’s very effortless to find out any matter on net as compared to books, as I found this article at this site.