We are here to inform you that the Government of Nigeria has approved and signed to release your over due payment of US$10,500,000.00

From The Desk of Federal Republic of Nigeria

Compliment of the season;

We are here to inform you that the Government of Nigeria has approved and signed to release your over due payment of US$10,500,000.00 and this money will be deliver to you through diplomatic immunity without any hindrance to your home address, we also advice you to quit from any further communication with whom soever it may concern to shun any interruption.

Furthermore, the diplomat is ready for the onward delivery of your fund but we want you to confirm your willingness over this delivery, and also you are advice to reconfirm your home address to avoid delivery to a wrong destination/person.

NOTE: Bear in mind that your total sum in question of US$10,500,000.00 have been packaged into Consignment Box (Brief case) meanwhile this fund is a clean fund and once the diplomat call you on phone in your Country do not hesitate to answer his call and pay proper attention to his given instructions, make sure to follow all his given instructions and also do not disclose the Consignment content to whom it may concern even the diplomat, tell anyone who ask you the Consignment content that your Consignment contain refundable clothes or jewelries for security purposes.

Furthermore, before the delivery of your Consignment commence we advice you to reconfirm your home address to us including telephone number. in 48 hours our diplomat will arrived in your international airport with your cash consignment box at your international airport.

{mr.henlyanderson@diplomats.com}
Thanks for your understanding.

Regards,
Mr. Douglas Terry

Email analysis :

NOTE : siglo21cotillon@speedy.com.ar
NOTE : mr.henlyanderson@diplomats.com
NOTE : Received : from localhost (13k.terra.com [208.84.242.163])
NOTE : (authenticated user siglo21cotillon!speedylm)
NOTE : by mail-smtp08-mia.tpn.terra.com (Postfix)
NOTE : siglo21cotillon@speedy.com.ar
NOTE : X-Origin : 41.86.234.165

NOTE : Importance : normal

SALINA BINTI ABD WAHAB

Account Holder, $550,000.00 usd,has been awarded to you by Oxfam(UAE) Please contact clearance officer with your Qualification Number.[OXG /101/231/BDB]Ref: AE/9420X2/68. via email:(oxfam.oxfamuae@lycos.com).

Email analysis :

NOTE : salinaaw@jkr.gov.my
NOTE : oxfam.oxfamuae@lycos.com
NOTE : X-Originating-Ip : [10.24.232.108]
NOTE : Received : from mx2-esg.1govuc.gov.my (mx2.1govuc.gov.my. [49.236.205.108])

Notes :

1govuc.gov.my seems hijacked.

Christy Walton

Greetings to you my dear beloved, I am Mrs. Christy Walton a citizen ofUnited States of America. I bring to you a proposal worth ($9,000,000,000.00) Nine Billion United State Dollars which i intend to use for CHARITY.Please reply me back

Email analysis :

NOTE : mchristywalton159@gmail.com
NOTE : info@fsmi.org
NOTE : Received : from 197.211.52.57 ([197.211.52.57])
NOTE : (proxying for 197.211.52.57)

NOTE : (SquirrelMail authenticated user ncar2010@fsmi.in)
NOTE : by webmail.fsmi.in
NOTE : User-Agent : SquirrelMail/1.5.2 [SVN]

Your Atm Card Of $5.5million usd,

HELLO! DEAR, GOOD NEWS TO YOU,

I have registered your ATM MASTER CARD valued $5.5 million usd with DHL COMPANY this morning as we agreed and the delivery will take off tomorrow morning based on my agreement with DHL Director Emma Eze MOST IMPORTANT:reconfirm your current delivery address to him then contact him via the following email:(caredhlcustomer@gmail.com

Am in Japan for investment project and i will not be reached till march 18th, 2016. Your amount in the Card is US$5.5Million and the Pin code of your ATM CARD is: {0609}

Thanks MR.AMU OMATA

Email analysis :

NOTE : parisconcertonetwo63@intuitspromo.com
NOTE : caredhlcustomer@gmail.com
NOTE : Originating-Ip : [104.243.24.187]

Compliment of the Season.

Attn: Sir/Madam

This message is coming to you From Federal Ministry of Finance. My name is Mr. Ibrahim Musa Tumsah the Director Internal Audit Department
Federal Ministry of Finance. while going through all the files in my office, I found out that your fund has been lying down unclaimed. I
asked what is the problem why the beneficiary can not make a claim on this fund, I found out that you need a Clearance Certificate from the Department Federal Ministry of Finance. My interest in contacting you is because I feel to help you get the requested document out from Department Federal Ministry of Finance and use it to transfer your fund. You have to reply back to me and give me go ahead to do the processing and transfer your fund.

I wait for your reply,

Regards,

Mr. Ibrahim Musa Tumsah
Director Internal Audit

Email analysis :

NOTE : owork3700@gmail.com
NOTE : uloelu1010@gmail.com

Your Order Has Been Placed (iTunes Store Phishing)

Apple: Order Number: 103993128

iTunes Store
Dear

Thank you for buying the following product on 18/01/2016

Product Name: F1-Pilot Premium(R)
Order Number: 103993128
Receipt Date: 18/01/2016
Order total: 14.02 EUR.

We hope that our tools and solutions have improved the way you do business this year.

If you did not authorize this purchase, please proceed with "Cancellation Form"

Cancel this Purchase

Phishing analysis :

CLICK : Cancel this Purchase
OPEN : https://directcabcall.com/dcc/cron/Update/login/
REDIRECT : http://https.paypatl.com.leodimiranda.com/nl/webapps/mf2f/home

Email analysis :

NOTE : Return-Path : < voveriukas@jml-group.lt >
NOTE : X-Php-Script : jml-group.lt/wp-content/files_mf/send.php for 105.108.42.181

NOTE : Received : from mail.ledinis.lt (mail.ledinis.lt. [109.235.64.119])

NOTE : Your Order Has Been Placed

Conclusion :

- iTunes Store phishing turning to Paypal phishing.

Hijacked websites :

directcabcall.com : owner : DIRECTCABCALL.COM@domainsbyproxy.com
leodimiranda.com : owner Irene Perrin / +61.386242485 / contact@myprivateregistration.com
jml-group.lt : UAB "Interneto vizija" / hostmaster@iv.lt
jml-group.lt : ress website / account voveriukas
ledinis.lt : UAB "Interneto vizija" / hostmaster@iv.lt

Phisher's origin :

IP : 105.108.42.181
Provider : Telecom Algeria
Country : Algeria
Latitude : 28
Longitude : 3