Automated Tax Refund Notification (HMRC Phishing)

If you can't see this message, view it in your browser.

HM Revenue & Customs

After the last calculations of your fiscal activity , we determined that you are aligible to receive a tax refund of 380.01 £.

To access your tax refund, please follow this link

NOTE: A refund can be delayed a variety of reasons , for exemple submitting invalid records or applying after deadline. Revenue and Tax Administrator

HM Revenue & Customs Tax Credit Office
PO Box 1970
L75 1WX.

Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.

Email screenshot :

Email analysis :

NOTE : bruce.stewart.agent@gov.uk
NOTE : X-Barracuda-Url : http://10.10.100.232:8000/cgi-mod/mark.cgi
NOTE : X-Barracuda-Connect : 173-12-155-133-northgulf.hfc.comcastbusiness.net
NOTE : [173.12.155.133]
NOTE : mailhost.towne.com
NOTE : X-Barracuda-Auth-User : besadmin
NOTE : X-Barracuda-Apparent-Source-Ip : 173.12.155.133

NOTE : client-ip=12.200.104.232;

Phishing anaylsis :

CLICK : this link
OPEN : http://educacaoadistancia.blog.br/wp-includes/hmrc/
REDIRECT : http://educacaoadistancia.blog.br/wp-includes/hmrc/startapplication/?*
SCREENSHOT :

CLICK : Let Start
REDIRECT : http://educacaoadistancia.blog.br/wp-includes/hmrc/startapplication/indentify.php?ip=*
SCREENSHOT :

FILL : FORM
CLICK : Next
SCREENSHOT :

NOTE : LOADING A FAKE REFUND...
CLICK : Start Refund
SCREENSHOT :

SELECT : A bank...
CLICK : Next
SCREENSHOT :

FILL : FORM
CLICK : Continue
SCREENSHOT :

CLICK : Confirm Tax Refund
SCREENSHOT :

REDIRECT : https://www.gov.uk/government/organisations/hm-revenue-customs

I thought you might be interested in this link

Hello!

Hello,

We offer Loan to serious individual or an Organization with low interest rate of 3% PA and maximum with no credit check, Loan period of 10yrs with Option of Rollover up to 2yrs. Loan Amount ranges from $1,000 Minimum up to a maximum of $20 Million with World Class standard facilities to make sure the funds gets to you at ease. all our loans & procedures are approved and qualified by our fully experienced compliance team. Equity Zen financial service has become one of the largest independent loan companies. We have an excellent reputation for the provision of first class financial loan products with exceptional customer service. any interested applicant should contact us to this Email: equityzenfinancialservice@gmail.com

Application Form To Fill Below..

Name:.............
Surname:...................
Gender:.......................
Country:...................
Date of Birth:.........................
Occupation:......................
Purpose for the loan:...................
Phone Number:...................
Loan amount needed:...........................
Duration:.................
Monthly income / annual income:....................

Thank You.

David Rosen

Click here to read the article.

If you have trouble viewing the link, copy and paste the following link into your browser:

http://www.***.com/_layouts/protiviti/emailtofriend.aspx

For more information on Protiviti, visit www.***.com.

Email leak :

calebshmidt13@gmail.com, neilrochford@mail.com, joncolbert62@yahoo.com, fracisb99@gmail.com, red3ds@hotmail.co.uk, abankwater@gmail.com, Ivorstiffun40@gmail.com, peter.larinzsky@mail.com, sanfran_4one9ersfan@yahoo.com, gregory138@outlook.com, elliotcaddy@yahoo.com, barb@excelquest.com, james.sullivan.sykes@gmail.com, craig.dole75@gmail.com, Williamjames@gmx.co.uk, john.smith431221@gmail.com, kevin.pesci.business@gmail.com, scottstorch1@gmail.com, christunstall113@yahoo.com, rngmusick@gmail.com, azzkikkr9000@gmail.com, adz2000sg@gmail.com, jonathanwalker121@gmail.com, martinmcpherson1980@gmail.com, johanna@dollsdancers.fi, jbankwater@gmail.com, andreym56@rothga.com, barrykrunt@gmail.com, cathymullernyc@gmail.com, obrawkins.nathan@gmail.com, christian.lemon@gmx.com, smatz97@gmail.com, Bradymartha55@gmail.com, laja602@outlook.com, booptittybopbop2@gmail.com, ted.sergeant@outlook.com, danielandersonprivate@gmail.com, justcallmeminty@gmail.com, chansenchristine@openmailbox.org, jessie_1186@outlook.com, everyrosehasitsthorn56@gmail.com, kohlmansean@gmail.com, oliverjohnson1979@gmail.com, gabrieler.wall@mail.com, fiets@lunitje.nl, calvinghaggerty@gmail.com, jpistmobank@gmail.com, noradam1@gmx.com, oli.dugmore@gmail.com, clalande1754@gmail.com, trip.jensen@gmail.com, hotsoolahx@yahoo.com, lewis.wake@hotmail.com, Capricehaywood@yahoo.con, thehumanfundfoundation@gmail.com, phyllisf2@comcast.net, benhess777@gmail.com, tellytubbins@gmail.com, michaelkoxlong@hotmail.com, info@waterfrontbarton.co.uk, hydrolichotdog@gmail.com, WilkesHenry@mail.com, josh.lyman432@gmail.com, info@regalcredit.org.uk, stan.bowers@techmarketproviders.com, danyelthefallen@yahoo.com, wilfred.martinson@yahoo.com, chuckaspeer2@gmail.com, melissastuder91@outlook.com, Dumaseura@gmail.com, alexhendrik00@hotmail.com, bgrompton@gmail.com, carlosmalaga2014@gmail.com, Ledbetter.antonio@yahoo.com, aaronthreepwood@gmail.com, david.mirren@gmail.com, sebastianhsh@live.com, rwdawson75@gmail.com, dionspencer230@gmail.com, iainjones2015@gmail.com, Ravensblackrevenge@gmail.com, ferdinand.gash@gmail.com, galtaureus3@gmail.com, bob.grimley1968@gmx.com, marek.folkos@seznam.cz, jonthorton1@gmail.com, rainman9292@gmail.com, vladeemervladimirovich@outlook.com, oliver.queen@dutchmail.com, dos.perros@gmail.com, timmywest88@gmail.com, drjack.johnson@yahoo.com, ericforman67@gmail.com, Amiller12@mail.com, bf.kurtons@gmail.com, jlinker29@outlook.com, lize.daily@gmail.com, mzeegen@outlook.com, gussyginny@gmail.com

Email analysis :

NOTE : equityzenfinancialservice@gmail.com
NOTE : client-ip=157.56.111.247;

DEAR BENEFICIARY

I,m Jeh Charles. Johnson. The secretary of the U.S Department of Homeland security Washington DC. Office Address: 3801 Nebraska Ave NW, Washington, DC 20016, United States. We received a report from ECOWAS that you have an abandoned fund worth $4.5 Million in West Africa. I have instructed ECOWAS and the concerned authorities to bring the consignment box to our Head office in Washington DC. the fund will arrive my office today. I want you to kindly Reconfirm Your Full Name, Current Home Address, Nearest Airport and your Direct Cell Phone # So that arrangement can be made for the delivery of the consignment to your home address. I can be reached at (213)295-1439

I wait to hear from you.

Honorable Jeh C. Johnson
The secretary of
the U.S Department of
Homeland security
Washington DC
Office Address:
3801 Nebraska Ave NW,
Washington, DC 20016,
United States.

Email analysis :

NOTE : www.@grace.ocn.ne.jp
NOTE : jehcharles007@gmail.com
NOTE : X-Originating-Ip : [43.231.232.17]

NOTE : Received : from mf-smf-ucb003.ocn.ad.jp
NOTE : Received : from mzcstore422.ocn.ad.jp
NOTE : client-ip=153.149.230.9;

NOTE : Content-Transfer-Encoding : 7bit

United Nations ATM Card Settlement This Season.

Attention: Beneficiary,

We have been having series of meetings for the passed 1 month now which ended 2 days ago with the Nigeria Government, and the former Secretary-General (Hon. Kofi Annan) to the UNITED NATIONS. Federal Reserve Bank of New York, HSBC Bank of United Kingdom (UK) with the World Bank Officials. This email is for all the people that have not been paid, for their contract/inheritance in any part of the world, the United Nations, Federal Reserve Bank of New York HSBC Bank of United Kingdom (UK) Reserve Bank of Nigeria, with the World Bank officials have agreed to compensate them with the sum of Four Million, Nine Hundred Thousand US Dollars each victim. This includes every foreign contractor that may have not received his or her contract sum and people that have had an unfinished transaction, people who have inheritance to claim or international businesses that failed due to instability of government in some part of World. We found your email address in our list and that is why we are contacting you, these have been agreed upon and have been duly signed.Therefore, we are happy to inform you that your ATM Card Number: 4120 5350 0015 has been approved and upgraded, via ZENITH BANK INT'L in your favor.Meanwhile, your Secret Pin Number will be available as soon as you confirm to us the receipt of your ATM CARD. The ATM Card Value is $6,300,000.00 USD Only. You are advised that a maximum withdrawal value of US$20,000.00 is permitted daily.And its is duly inter-switched and you can make withdrawal in any location of the ATM Center of your choice/nearest to you any where in the world. We have also concluded delivery arrangement with our accredited courier service Company DHL or Fedex to deliver your package to your door step. Be informed that your response would be by telephone or through email Only.Any further delay will be the pleasure of the UNRC to use your fund to help the people who have been displaced in Darfur, Sudan Africa which you can see it in this site http://www.savedarfur.org/ and the Tsunami's victims in Asia. So you are hereby advice to forward to this office Director ATM SWIFT CARD Department Therefore, you should send him your full Name and telephone number/your correct mailing address where you want him to send the ATM to you. Contact Person Apostle Robert Gate immediately for yourATM SWIFT CARD:

Person to Contact Apostle Rolland Eze E-mail: { fundscompenssation@qq.com } We are working according to the constitution binding this committee as well as helping the less privilege through this means. You will be required to contact the above mentioned institution via telephone or email. Hoping to hear from you as soon as you receive your ATM card.

1.YOUR FULL NAME ................
2.PHONE AND FAX NUMBER...............
3.ADDRESS WERE YOU WANT US TO SEND THE ATM CARD...............
4.A Copy Of Your Identity Attached To e-mail

Best Regards,

Mr. Ban-Ki Moon

Email analysis :

NOTE : United Nations ATM Card Settlement This Season.
NOTE : appostles-rolland@mail.com
NOTE : fundscompenssation@qq.com
NOTE : 5.200.37.74 ()
NOTE : Received : from unknown (HELO ps-1c.ru) (5.200.37.74)

no reply (Phishing Crédit Agricole)

Cher(e) abonné(e),

Cet email a été envoyé par l'équipe Crédit Agricole pour vous informer que nous n'avons pas pu traiter votre paiement de facture.

Ceci pourrait être du a l'une ou l'autre des raisons suivantes:

1.Un changement récent de vos informations personnelles. (par exemple : adresse de facturation, téléphone..)

2. Soumission d'informations incorrecte pendant le processus de paiement de facture.

Pour s'assurer que votre service ne soit pas interrompu, nous avons invitons à confirmer et à mettre à jour toutes vos informations de facturation en cliquant ici:

ACCÈS

Votre Service Clients reste à votre écoute 24h/24h, 7J/7.

Cordialement,

Email analysis :

NOTE : no-reply@rdp.fr
NOTE : webmaster@web.pharmalink.cz
NOTE : X-Php-Originating-Script : 33:admin.php
NOTE : Received : by ispc03.suptech.cz (Postfix, from userid 33)

Phishing analysis :

CLICK : ACCÈS
OPEN : http://www.lacurvadeibaci.it/a/Agricole
RESULT : Phishing is unresponsive

Lt Selina Nitra

Hi dear,

you are very nice

I wish i could get to know you for it is my pleasure to have you as my friend for a friend is all about Respect,,,Admiration,contentious and affectionante also friendship is consist of sharing of ideas and showing true affection without cheats,,,lies and betray so can you welcome me, lets get to the ocean of love ?????????????

I am Lt Selina Nitra by name

Email analysis :

NOTE : Hi
NOTE : ltseliinarespect@hotmail.com
NOTE : client-ip=212.82.97.77;

NOTE : Mime-Version : 1.0
NOTE : Received : from jws11193.mail.ir2.yahoo.com
NOTE : by sendmailws168.mail.ir2.yahoo.com