During your last purchase (Phishing Paypal)

Header Image

Privacy Policy for PayPal Services Copyright ©2016

PayPal fraud prevention set standards by presenting the best security solution in the industry that make your business more secure.If you do not renew your paypal account will be limited or closed permanently

Update Your Account Info. Please click below.

Thank you for choosing PayPal

border

Copyright ©2016 All rights reserved.

Email analysis :NOTE :

NOTE : Return-Path : < *@sendgrid.net >
NOTE : Mime-Version : 1.0
NOTE : Content-Transfer-Encoding : quoted-printable
NOTE : X-Mailer : ColdFusion 9 Application Server
NOTE : client-ip=50.31.42.127;
NOTE : Received : from o1.email.britishsoapawards.tv ([50.31.42.127])
NOTE : Received : by filter0036p1las1.sendgrid.net
NOTE : Received : from vaya-backend09-optusrts (unknown [103.1.216.177])
NOTE : by ismtpd0018p1sin1.sendgrid.net (SG)
NOTE : During your last purchase

Phishing analysis :

CLICK : THE BUTTON
OPEN : https://bit.ly/1RFlDg4
REDIRECT : http://64.71.78.238/CFIDE/web.html
REDIRECT : http://horseridingholidaysgb.co.uk/php/update_info*/True-Login/*/signin.php
SCREENSHOT :

CLICK : Log In
REDIRECT http://horseridingholidaysgb.co.uk/php/update_info*/True-Login/*/signin.php?error_login_id=*#

NOTE : THE LOGIN ASK FOR A VALID PASSWORD...
NOTE : SHORT THE URI TO http://horseridingholidaysgb.co.uk/php/update_info/
SCREENSHOT :

NOTE : FUNNY...
NOTE : CHANGE IP
SCREENSHOT :

NOTE : LAUGHT...

Do you need a loan? $5,000.00 to $1,000,000.00 at 2%

Do you need a loan? $5,000.00 to $1,000,000.00 at 2%, Interested and serious person contact us.

Name:
Amount needed:
Duration:
country:
Mobile Number:

Thanks.

Email analysis :

NOTE : unbloaninvestment@gmail.com
NOTE : phong_tdda_skhdt@bacgiang.gov.vn
NOTE : Return-Path : < phong_tdda_skhdt@bacgiang.gov.vn >
NOTE : X-Originating-Ip : [10.9.11.2]
NOTE : Dkim-Filter : OpenDKIM Filter v2.9.2 mta1.bacgiang.gov.vn E73EA1220B5
NOTE : Mime-Version : 1.0
NOTE : Message-Id : < *.*.*.JavaMail.zimbra@bacgiang.gov.vn >
NOTE : X-Mailer : Zimbra 8.6.0_GA_1153 (ZimbraWebClient - GC51 (Win)/8.6.0_GA_1153)
NOTE : Thread-Topic :
NOTE : client-ip=125.212.128.218;
NOTE : Received : from mta1.bacgiang.gov.vn (mail.bacgiang.gov.vn. [125.212.128.218])

NOTE : Received : from localhost (localhost [127.0.0.1])
NOTE : by mta1.bacgiang.gov.vn (Postfix)
NOTE : Received : from mta1.bacgiang.gov.vn ([127.0.0.1])
NOTE : by localhost (mta1.bacgiang.gov.vn [127.0.0.1])
NOTE : Received : from localhost (localhost [127.0.0.1])
NOTE : by mta1.bacgiang.gov.vn (Postfix)
NOTE : Received : from mta1.bacgiang.gov.vn ([127.0.0.1])
NOTE : by localhost (mta1.bacgiang.gov.vn [127.0.0.1])
NOTE : Received : from mailstore1.bacgiang.gov.vn (unknown [10.9.11.12])
NOTE : by mta1.bacgiang.gov.vn (Postfix)
NOTE : The bacgiang.gov.vn servers were used to relay this scam.

vous avez un nouveau ✉ (Phishing CIC)

CI C

Cher(e) Client(e),

Lors de votre dérnier achat, vous avez été averti par un message vous informant de l'obligation d'adhérer à la nouvelle réglementation concernant la fiabilité pour les achats par C.B sur internet et de la mis en place d'un arrét pour vos futurs achats

Or, nous n'avons pas, ce jour , d'adhésion de votr part et nous sommes ou regret de vous informer que vous pouvez plus utiliser votr cart sur internet

Adhésion : cIiquant ici

Merci de la confiance que vous nous témoignez

Cordialement

Conseil d'administration

Email screenshot :

Email analysis :

NOTE : mdl@geosoc.fr
NOTE : Content-Type : text/html; charset=iso-8859-1
NOTE : Return-Path : < www-data@geosoc.fr >
NOTE : Received : from geosoc.fr ([84.39.46.170])
NOTE : Received : by geosoc.fr (Postfix, from userid 33)
NOTE : X-Php-Originating-Script : 0:lkhourza.php
NOTE : Message-Id : < 20160628050458.0648121078@geosoc.fr >
NOTE : vous avez un nouveau ✉

Phishing analysis :

CLICK : Adhésion : cIiquant ici
OPEN : http://royalapparels.com/cgi/
REDIRECT : http://marcellocampos.com.br/loja/magmi/state/-/mpl/lpf/zero/normal42/accorde/*
REDIRECT : http://marcellocampos.com.br/loja/magmi/state/-/mpl/lpf/zero/normal42/accorde/*/lb.php?id=*&default=*
SCREENSHOT :

CLICK : OK
SCREENSHOT :

NOTE : ANALYSIS WITH NO REDIRECT IF THE PASSWORD IS WRONG

Domain analysis : marcellocampos.com.br

domain: marcellocampos.com.br
owner: Marcelo Campos
responsible: Turbo Web Internet
country: BR
owner-c: MAACA45
admin-c: ZAB
tech-c: WAA218
billing-c: MAACA45
nserver: nsbra16.hostgator.com.br
nsstat: 20160627 AA
nslastaa: 20160627
nserver: nsbra17.hostgator.com.br
nsstat: 20160627 AA
nslastaa: 20160627
created: 20070704 #3724896
expires: 20220704
changed: 20150719
status: published
nic-hdl-br: MAACA45
person: Marcelo Andr? de Campos
created: 20070109
changed: 20160126
nic-hdl-br: WAA218
person: Willianson de Almeida Araujo
created: 20050409
changed: 20130401
nic-hdl-br: ZAB
person: Zilda Aparecida Bagattini
created: 19971223
changed: 20151230

Dr. David Patrick

Read carefully ,

This is to inform you that International Monetary Fund IMF is compensating all the scam victims $2.700,000.00USD each, and your email address was found in the scam victim's list. This Western Union head office has been mandated by the IMF Director to transfer your compensation fund to you via Western Union Transfer Daily. We the western union office here stated that you will be receiving your fund $2.700.000.00 at the maximum of $5,000.00 daily until the whole money is completely transfer to you. We have sent out your first payment $5,000 but it placed on hold because your payment is not yet activated. BELOW IS YOUR FIRST PAYMENT $5,OOO.OOUSD but still on hold

MTCN#________________________ 8860-3341-09#
Sender’s First Name:------- David
Sender’s Last Name:------Patrick
Sender’s Location:------- Seattle,Benin Republic
Amount sent:------- $5000

Remember we need your full information as where we will be sending the funds, such as to avoid wrong transfer,

Receiver name:-________
Address:-__________
Country:-____________
Phone number:-_____________

Note that you are not expected to pay for transfer charges all the fee has been paid by International Monetary Fund the depositor. The only fee you will you send before you will start picking up your daily payment $5,000.00 as it was sign is only $105.00 for the activation of your western union payment transfer files. Note that your payment files will be returned to the IMF within 72 hours if we did not hear from you, this was the instruction given to us by the IMF.

Contact us Below:westernunionm4@gmail.com
Call me now +229-98151176

Thanks,
Dr.David Patrick
The Western Union Director Benin Republic
Call me now +229-98151176

Email analysis :

NOTE : westernunionm4@gmail.com
NOTE : massage.@ocn.ne.jp
NOTE : X-Originating-Ip : [104.167.217.234]

Steiner, D Ms : Dir NEPAD, Africa Multilateral, DIRCO

Hello, can i share with you a business? kindly reply!! (sergio_bed111@163.com)

Disclaimer: This email and files transmitted with it contain confidential and privileged information and are intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please -

- do not read, disseminate, distribute, copy or take action in reliance on this email and
- delete it immediately and arrange for the deletion thereof on your server, and
- notify the administrator of the Department of International Relations and Cooperation at postmaster@dirco.gov.za immediately.

Any unauthorised, use duplication or interception of this e-mail or any files transmitted with it is expressly and strictly prohibited. No representation, guarantee or undertaking (expressed or implied) is made or given

- As to the confidentiality or security of the e-mail system' Or
- As to the accuracy of the information in this email and any files transmitted with it is virus-free.

No responsibility or liability is accepted for:

- the proper, complete transmission of the information contained in this email or any files transmitted with it or any delay in its receipt; or rising from or as a result of the use of or reliance on the content of this email or any files transmitted with it. Any views expressed in this email or any files transmitted with it are not necessarily the views of the Department of International Relations and Cooperation. Queries regarding this emails or any files transmitted with it, should be directed to postmaster@dirco.gov.za.

This disclaimer forms part of the content of this e-mail for purposes of section 11 of the Electronic Communications and Transactions Act, 2002 (Act No. 25 of 2002)

Email analysis :

NOTE : SteinerD@dirco.gov.za
NOTE : Content-Language : en-ZA
NOTE : Mime-Version : 1.0
NOTE : client-ip=196.14.41.164;

FW: Your Shipping Documents (DHL Phishing)

Shipping Documents Receiver's eMail: ***@***.com

Greetings,

As instructed by your shipper, we have attached below the secured PDF copies of your shipping documents and your shipment tracking details from our international logistic partner, DHL Epress.

Click Here To View Your Documents And Shipment Tracking Details : www.dhl.com/documents/0094325.pdf

At Co-Logistics we offer best Service Delivery Commitment with shipper & client.

*´¨)
¸.• ´¸.•*´¨) ¸.•*¨)
(¸.•´ (¸.•'* Best Regards
(¸.•'* .•*´¨)
Smith Wan *
(¸.•'*
Sales Excutive

Cooperate Logistics Co.,Ltd
************************

Head Office
Rm 2401-2502,Guidu Bld, Chungfeng Rd,
Luohu, Shenzhen, China
Phone: (86) 755 88863799
Email: info@co-logistics.com
URL: www.co-logistics.com
Image result for Carrier: DHL FedEx UPS TNT

Phishing analysis :

CLICK : www.dhl.com/documents/0094325.pdf
REDIRECT : http://namaren.com/jyg/DHL/tracking.php?userid=***@***.com

Email analysis :

NOTE : jbarba@morsco.com
NOTE : Mime-Version : 1.0
NOTE : X-Originating-Ip : [14.139.59.197]

NOTE : client-ip=157.56.111.70;

Phyllis Riccia

Greetings, We've obtained your details from career builder Inc, Database, and considered you as an ideal representative for the HOME-BASED job position detailed below. I am Mr Phyllis  Riccia, Chief Executive Officer of Equator Oil and Gas Ltd. We are an OPEC member that deals on crude oil, raw materials and export to Canada, United Kingdom, America,Europe and Asia.We are searching for receiving/payment officer who can help us establish a medium of getting to our customers as well as making payments through you to us. Also as part of our vision to help in eradicating JOBLESSNESS in the global world. We are now seeking qualified personnel to be our company offshore REPRESENTATIVE. We would like to use this medium to inform you that a vacant position exists for you in our CREDIT and PAYMENT COLLECTION DEPARTMENT. Export Company. Fill the details below FULL NAME................. FULL HOME ADDRESS.......... CITY....... STATE..... ZIP CODE.... AGE... PHONE/FAX NUMBERS............ OCCUPATION................. Mr Barriter Christian Paul Chief Executive Officer Equator Oil and Gas Ltd. N:B:  All we need is your Trust, Honesty & Communication.    Mr, Phyllis  Riccia.

Email analysis :

NOTE : phriccia@yahoo.com
NOTE : ricciap@yahoo.com
NOTE : X-Yahoo-Newman-Property : ymail-3
NOTE : Mime-Version : 1.0
NOTE : 98.138.91.114

Private Discussion

Hello,
I am looking for a joint business partner to invest $ 26 million value.

Find my private e-mail: jo853268074_3442145@yahoo.com , to reply if you are interested.

Dr. Jorasse

Email analysis :

NOTE : emp.tihc@yahoo.ca
NOTE : info@expo-viagens.pt
NOTE : client-ip=213.13.175.87;

NOTE : Received : from [192.168.8.100]
NOTE : (unknown [41.85.189.163])

United Nations Compensation Commission (UNCC)

Attention;

This is coming to you in regards to the recent meeting within the United Nations based on the Agreement with the World Bank Assistance Project. This email come to those who are yet to receive their compensation/inheritance/winnings and who have been scammed in any part of the world, this includes every foreign contractors that may have not received their contract sum, and people who had unfinished transaction or Compensation payments which failed due to Government problems etc. The UNITED NATIONS have agreed to compensate you with the sum of $4,700,000.00 USD (Four Million, Seven Hundred Thousand United States Dollars). Your name and email was in the list submitted by our Monitoring Team observers and this is why we are contacting you, this has been agreed upon and signed. You are advised to contact Mr. Alex Bates, as he is our representative in the USA. Contact him immediately for your Compensation payment of $4,700,000.00 USD (Four Million, Seven Hundred Thousand United States Dollars) which will be released directly to you through an ATM MasterCard in accordance with legal clearance and procedures. However, you should send him your Full Name/Telephone Number/Residential Address/Gender and Occupation. Contact Mr. Alex Bates immediately for your compensation payment by replying to this email or emailing the address below:

Mr. Alex Bates
Email Address: info.alexbates@gmail.com

I expect your urgent attention to this email to enable me monitor this payment effectively. Most importantly you shall be requested to pay the sum of $350 only covering the application fee, processing fee, evaluation fee and mailing cost of your ATM MasterCard with 100% no extra charge or hidden fees involved. Payment will be made to our payment office in the USA only.

Good luck and kind regards,
Making the world a better place!

Yours Faithfully,

Dr. Joan Clos I Matheu.
Executive Director United Nations Human Settlements Programme
United Nations Compensation Commission (UNCC)

Email analysis :

NOTE : info.alexbates@gmail.com
NOTE : Received : from mail.com
NOTE : (158.ip-149-56-134.net [149.56.134.158])

Promo Telecom - TIM

Vuoi navigare alla massima velocità e chiamare tutti illimitatamente? Scegli la qualità! Passa a Tim Impresa Semplice, il partner ideale per il tuo Business. Ecco l'offerta di rete fissa riservata ai nuovi clienti (valida sia per i nuovi impianti telefonici sia per i passaggi da altro gestore)

TUTTO

1 LINEA: 35 euro al mese + iva per SEMPRE
2 LINEE (ISDN): 60 euro al mese + iva per SEMPRE

- Internet ILLIMITATO fino a 30 Mega in copertura Fibra
- Telefonate ILLIMITATE verso tutti i numeri Fissi e Mobili nazionali
- Router WiFi con installazione inclusa
- 1 indirizzo IP statico
- Chi è, Avviso di chiamata e Trasferimento di chiamata inclusi
- No canone Telecom
- Nessuna quota di attivazione
- Assistenza garantita in 24 h

E per il tuo cellulare scopri i vantaggi della PROMO VIP e della PROMO CRASH che ti consentono di avere chiamate ed SMS illimitati e internet a volontà con velocità 4G RISPONDICI via EMAIL rilasciandoci un tuo recapito telefonico per essere contattato da un nostro Consulente e approfondire senza impegno le offerte di rete fisse e mobile.

Cordiali Saluti

Business Partner Telecom-TIM
Commerciale Multibrand
Soluzioni per la Telefonia & Energia

Email analysis :

NOTE : 164.132.34.3
NOTE : info@sfcmultibrand.it
NOTE : client-ip=95.227.233.46;

Rép : Confirm Your Payment With United Nations 511

Our Ref: CITI/BKL/STB
Your Ref:

======================================================

WORLD BANK GROUP AND UNITED NATION ORGANIZATION do hereby give this irrevocable approval order with Release Code: GNC/3480/02/00 in your favor for your contract entitlement/award winning payment with the UNITED NATION to your nominated bank account.. Now your new Payment, United nation Approval No;UN5685P,White House Approved No:WH44CV, Reference No.-35460021, Allocation No: 674632 Password No: 339331 ,Pin Code No: 55674 and your Certificate of Merit Payment No : 103 ,Released Code No:0763; Immediate Citibank Telex confirmation No:-1114433 ; Secret Code No: XXTN013, Having received these vital payment number , therefore You are qualified now to received and confirm Your payment with the United Nation immediately within the next 72 hrs. As a matter of fact, you are required to Deal and Communicate only with MR SCOTT PETERS, DIRECTOR INTERNATIONAL REMITTANCE CITIBANK OF UNITED KINGDOM, with the help and monitory team from the CITIBANK OF NEW YORK which is our official remitting bank, Committee On Foreign Payment Matters in United Nation, has look up to make sure you receive your fund valued $8.3m. So contact: MR SCOTT PETERS on his contact information, Direct Telephone Number: +447087645791 Email: scott.peters36@aol.com for immediate release of your contract/inheritance/Award Winning claim Be informed that you are not allowed to correspond with any person or office anymore, You are required to send bellow information for your transfer.

1) YOUR FULL NAME:
2) ADDRESS, CITY, STATE AND COUNTRY.
3) PHONE, FAX AND MOBILE
4) COMPANY NAME (IF ANY) POSITION AND ADDRESS
5) BANK DETAILS, BANK NAME ACCOUNT NO, ROUTING NO, /SWIFT CODE AND BANK ADDRESS.
6) PROFESSION, AGE AND MARITAL STATUS MARRIED
7) COPY OF YOUR INT'L PASSPORT/DRIVERS LICENSE

NOTE: YOUR PERSONAL CONTACT/COMMUNICATION CODE WITH CITIBANK IS(511),YOU ARE ADVICE TO SEND YOU FULL BANKING INFORMATION TO THE CITIBANK OF LONDON INTERNATIONAL REMITTANCE DIRECTOR HEADED BY MR SCOTT PETERS AND MAKE SURE YOU SPEAK WITH HIM, WITH YOUR NEW PAYMENT CODE FOR RELEASE OF YOUR PAYMENT AND SEND HIM ALL YOUR BANKING
INFORMATION NOW.

CONTACT CODE (511)
OFFICER: MR SCOTT PETERS.
POSITION: DIRECTOR, INTL, REMITTANCE CITIBANK LONDON.
Telephone No +447087645791.
Fax Number: +448435622418,
EMAIL: scott.peters36@aol.com

MR. MARCEL A.BOISARD.
(CHAIRMAN COMMITTEE ON FOREIGN CONTRACT/AWARD WINNING PAYMENT UNITED NATION AND USA GOVERNMENT).

Email analysis :

NOTE : umi-bun@apricot.ocn.ne.jp
NOTE : scott.peter778@yahoo.es
NOTE : notice@citibank.co.uk
NOTE : Received : from wsip-70-169-155-102.hr.hr.cox.net
NOTE : ([70.169.155.102]:53335 helo=User)

NOTE : by default.servername.com with esmtpa (Exim 4.87)

HBR Shared Content from Mr. Ayoo Blah Vincent

From Mr. Ayoo Blah Vincent Abidjan, Côte d'Ivoire West Africa. E-mail:ayooblahvincent@vfemail.net Tel: 225 40 18 10 95 AgriBusiness Partner Needed. DEAR SIR How are you, I hope you are well and fine. I came to know of you while making a private search for agribusiness partner, I am Mr. Ayoo Blah Vincent a native of Baoule, most popular tribes here in my country cote d'iviore, I study here in the university and will be graduating in the next year, i have come to understand that an investor doesn't rely on good luck. Instead, they take the time to consider their investment goals. Then they develop a plan and choose investments that align with their needs and objectives. This is the reason why i am writing you this mail to seek your cooperation in developing the resourcess in my care, I stand as the eldest son of my parent ,late Mr and Mrs Ayoo Blah the rightfull owner of many forest in the west and north of COTE D'IVIORE , my father while still alive sold some potions of lands and forest to chinest investors,and to government the most recongnised forest in the capital city of the economic capital of the country known as BANCO FOREST here in abidjan.and kept the money in suspense accord which is duelly for onward transfer for investment. Sir, its with the vission of becoming an international business investor and i wish to seek collarboration with you to invest in AgriBusiness parternship , the forest exploration,Raw minierals and also lands development with the funds already deposited in the bank by our late parent,therefore, our business plan is to associate with a capable hands to transfer this funds to a secure account abroad. i will be very happy to work with you with all sincerity as i can assure you of good benefits if you can stand as our family business partner and secure this funds to your account for the investment. Looking forward to your soonest response. Yours sincerely. Mr. Ayoo Blah Vincent E-mail:ayooblahvincent@vfemail.net Tel: 225 40 18 10 95

To Develop Cultural Dexterity, Seek It Out
What military service taught me about bridging diverse groups.

HBR content shared by Mr. Ayoo Blah Vincent
VIEW LIST ON HBR.ORG
Interested in creating, editing and sharing content lists of your own?
Set up your free account and start using My Library on HBR.org today.

GO TO MY LIBRARY ON HBR.ORG NOW >

Email analysis :

NOTE : reply@hbr.messages5.com
NOTE : email@hbr.messages5.com
NOTE : client-ip=74.112.71.186;

I NEED YOUR QUICK REPLY.

Dear Beloved,

Please this is important and urgent as well as confidential that is why I kindly ask you to reply via this my direct and personal email address: mrsgracammachel@gmail.com With due respect, I must apologize for this unsolicited message, I am aware that this is certainly not a conventional way of approaching an unknown person for establishment of project and investment. But I respectfully insist you read this message carefully before you either take a decision of proceeding or deleting my message as I am optimistic it will be successful for unimaginable financial benefit for both of us and our families. I am Mrs. Graca Machel Mandela the wife of South African icon and freedom fighter late Nelson Rotlatla Mandela The former President of the republic South Africa from 1994 till1999 who died on December 5, 2013 after a protracted lung infection contacted during his 27th years of incarceration in robin island prison. Actually, I managed to get your contact details online here in Johannesburg South Africa in my desperate search for a trustworthy person to assist me in this confidential business transaction. (http://en.wikipedia.org/wiki/Gra%C3%A7a_Machel) As the Third wife of late Nelson Mandela, he deposited cash in a trust account on my name here in south Africa, for self keeping, he did this because he knew that upon his death, his lioness x-wife Winnie Mandela might use all her structural contacts within the AFRICAN NATIONAL CONGRESS [ANC] to deny me what is due to me as his wife who looked after him all this period he was on sick bed. As his instinct pre-informed him, his fears is ongoing right now, and as a Mozambican, all the family members have swooped on me, Opposing me that I should hand over the asset to them, and good of a thing that when my late husband deposited the money into the trust fund account on my hand we used my sons name, Mr. Malengani Machel, who is currently living here in Johannesburg South Africa, for security reason. My late husband, Nelson Mandela, deposited US$60.5 MILLIONS (Sixty Millions, Five Hundred Thousand United States Dollars) in cash in a bank here in South Africa through diplomatic channel, After his death, I and my son being in Johannesburg South Africa, decided to transfer this money out of South Africa for my family use since it is the only confidential thing we benefited. I have relinquished and waved most of his assets /estate willed to me as we are married in community of property for the interest of peace. This is genuine and not of criminal origin. I must then emphasize that this transaction is highly confidential and it is to be kept as such confidential. Therefore indicate your full interest on assurance of trust, so that we can actualize this great opportunity together and share the benefit together by the help of God. And in the area whereby you are not interested in this deal please kindly delete it immediately from your email. If you are interested, kindly provide me with your full names and direct private phone numbers.

Regards in sincerity,

Mrs Graca Machel
4th Street Houghton Estates
Johannesburg South Africa
Phone: No. +27839733172
Email: mrsgracammachel@gmail.com

Email analysis :

NOTE : gracamachel@hotmail.com
NOTE : vw1@arcor.de
NOTE : X-Webmailclientip : 41.246.151.201

no-reply (Phishing Hellobank > Free)

Hellobank!

Chère(e) Abonnée

vous avez un error de prélèvment freemobile , veuillez vérifier votre espace client dans le plus tot possible :

Montant : 32.01 €

vérifier maintenant

Hellobank!, SA au capital de 2 492 770 306 euros - Siège social : 16, boulevard des Italiens - 75009 PARIS. Immatriculée sous le n° 662 042 449 RCS PARIS - Identifiant CE FR76 662 042 449 - ORIAS n° 07 022 73.

Email screenshot :

Email analysis :

NOTE : no-reply@crypt.com
NOTE : Content-Type : text/html; charset=iso-8859-1
NOTE : Mime-Version : 1.0
NOTE : Return-Path : < webmaster@web.pharmalink.cz >
NOTE : Received : from ispc03.suptech.cz ([81.19.11.204])
NOTE : Received : by ispc03.suptech.cz (Postfix, from userid 33)
NOTE : X-Php-Originating-Script : 33:admin.php
NOTE : no-reply

Phishing analysis :

CLICK : vérifier maintenant
OPEN : http://www.bollettiamo.it/
REDIRECT : http://www.bollettiamo.it/.../aa/HelloEspace/*/
SCREENSHOT :

CLICK : Accéder aux comptes

REDIRECT : http://www.bollettiamo.it/.../aa/HelloEspace/*/free/moncompte/index.php
SCREENSHOT :

Domain analysis :

Domain: bollettiamo.it
Status: ok
Organization: Luca Santaniello
Name: Luca Santaniello
Organization: Luca Santaniello
Name: Luca Santaniello
Organization: Luca Santaniello
Organization: Aruba Business s.r.l.
Name: WIDE-REG
Web: http://www.arubabusiness.it
Nameservers dns.widhost.net
Nameservers dns2.widhost.net

vous avez un message (Phishing CIC)

CI C

Cher(e) Client(e),

Lors de votre dérnier achat, vous avez été averti par un message vous informant de l'obligation d'adhérer à la nouvelle réglementation concernant la fiabilité pour les achats par C.B sur internet et de la mis en place d'un arrét pour vos futurs achats Or, nous n'avons pas, ce jour , d'adhésion de votr part et nous sommes ou regret de vous informer que vous pouvez plus utiliser votr cart sur internet

Adhésion : cIiquant ici

Merci de la confiance que vous nous témoignez

Cordialement

Conseil d'administration

Email screenshot :

Email analysis :

NOTE : Content-Type : text/html; charset=iso-8859-1
NOTE : Mime-Version : 1.0
NOTE : Return-Path : < iidheldo@meo.fr >
NOTE : Received : from meo.fr ([84.39.48.4])
NOTE : Received : by meo.fr (Postfix, from userid 33)
NOTE : X-Php-Originating-Script : 0:LKJDKJFD.php
NOTE : vous avez un message

Phishing Analysis :

CLICK : Adhésion : cIiquant ici
OPEN : http://jupiterapparel.com/slk
REDIRECT : http://aidyourlifestyle.com/cgi-sys/suspendedpage.cgi
RESULT : Phishing attempt

Domain analysis :

Domain Name:aidyourlifestyle.com
Registrant Name:Zhern Je Lee
Registrant Country:my
Registrant Phone:+601.0000000
Registrant Email:leezhernje@gmail.com
Admin Name:Zhern Je Lee
Admin Email:leezhernje@gmail.com
Tech Name:Zhern Je Lee
Tech Email:leezhernje@gmail.com
Name Server:NS1011.NEWIPDNS.COM
Name Server:NS1012.NEWIPDNS.COM
====================================
Domain Name: jupiterapparel.com
Registrant Name: Jupiter Apparel
Registrant Organization: Jupiter Apparel
Registrant Street: A - 31, Ram Nagar, Om Vihar
Registrant City: New Delhi
Registrant State/Province: Delhi
Registrant Postal Code: 110059
Registrant Country: IN
Registrant Phone: +91.25334910
Registrant Fax: +91.25331259
Registrant Email: anshul@gsspl.com
Admin Name: Jupiter Apparel
Admin Organization: Jupiter Apparel
Admin Street: A - 31, Ram Nagar, Om Vihar
Admin City: New Delhi
Admin State/Province: Delhi
Admin Postal Code: 110059
Admin Country: IN
Admin Phone: +91.25334910
Admin Fax: +91.25331259
Admin Email: anshul@gsspl.com
Tech Name: Jupiter Apparel
Tech Organization: Jupiter Apparel
Tech Street: A - 31, Ram Nagar, Om Vihar
Tech City: New Delhi
Tech State/Province: Delhi
Tech Postal Code: 110059
Tech Country: IN
Tech Phone: +91.25334910
Tech Fax: +91.25331259
Tech Email: anshul@gsspl.com
Name Server: ns63.domaincontrol.com
Name Server: ns64.domaincontrol.com

Régler votre Situation (Phishing Boursorama)

Bonjour,

Suite au double payement d'une facture par erreur sur votre compte. veuillez completer votre formulaire de remboursement, Pour consulter, Veuiller cliquez sur le lien ce-dessous :

Régler votre situation

Nous vous remercions de votre confiance.

Ce courriel vous a été envoyé par un système automatique d'émission de messages. L'adresse d'émission n'est pas une adresse de courriel classique. Si vous écrivez à cette adresse, votre message ne sera pas pris en compte

Sboursorama| Cl to view the online version

Email screenshot :

Email analysis :

NOTE : X-Php-Originating-Script : 0:lc.php
NOTE : www-data@zankyou.fr
NOTE : aa@zankyou.fr
NOTE : Received : by zankyou.fr (Postfix, from userid 33)
NOTE : Received : from zankyou.fr ([185.107.213.201])

Phishing analysis :

CLICK : Régler votre situation
OPEN : http://inter-mask.com/br.php
REDIRECT : http://inter-mask.com/cgi-sys/suspendedpage.cgi
RESULT : Phishing attempt.

Domain analysis :

Domain Name: inter-mask.com
Registrant Name: Gulshan Nadeem
Registrant Organization: AQC
Registrant Street: Pacca Garah
Registrant City: Sialkot
Registrant State/Province: Punjab
Registrant Postal Code: 51310
Registrant Country: PK
Registrant Phone: +92.3006146147
Registrant Fax: +92.3006146147
Registrant Email: gnadeem786@gmail.com
Admin Name: Gulshan Nadeem
Admin Organization: AQC
Admin Street: Pacca Garah
Admin City: Sialkot
Admin State/Province: Punjab
Admin Postal Code: 51310
Admin Country: PK
Admin Phone: +92.3006146147
Admin Phone Ext:
Admin Fax: +92.3006146147
Admin Email: gnadeem786@gmail.com
Tech Name: Gulshan Nadeem
Tech Organization: AQC
Tech Street: Pacca Garah
Tech City: Sialkot
Tech State/Province: Punjab
Tech Postal Code: 51310
Tech Country: PK
Tech Phone: +92.3006146147
Tech Phone Ext:
Tech Fax: +92.3006146147
Tech Email: gnadeem786@gmail.com
Name Server: ns1.vnameu.net
Name Server: ns2.vnameu.net

24-06-2016 -- Facture n° 11-543167929 (Phishing Free)

Free Mobile

Chèr(e) Freenaute,

Vous êtes abonné au forfait Free Haut Débit.

Conformément à la facture n° 11-543167929 établie le 10 jun 2016

nous avons émis une demande de prélèvement auprès de votre établissement bancaire.

Il semble que ce prélèvement ait été refusé par votre banque pour le

motif suivant : "Absence de provision ou provision insuffisante (20)"

Afin de régulariser votre situation au plus vite auprès de nos services,

nous vous remercions de bien vouloir nous faire parvenir votre règlement :

- par chèque, établi à l'ordre de Free Haut Débit (veuillez ne pas

oublier de mentionner le numéro de téléphone de la ligne concernée au dos du chèque),

à l'adresse suivante : Free Haut Débit 75371 PARIS CEDEX 08

- ou par carte bancaire, directement en ligne à l'adresse suivante :

http://www.free,fr/login/compte/facture_n11-553167929/

Persuadés qu'il ne s'agit que d'un incident isolé, nous vous prions de

bien vouloir procéder à la régularisation de votre situation dans les

meilleurs délais afin d'éviter l'ouverture d'une procédure de recouvrement

consécutive à l'impayé.

Vous avez la possibilité de consulter vos factures en ligne à tout moment

à l'adresse http://www.free.fr/

L'équipe Free Haut Débit.

FAQ : http://www.free.fr/faq/"

Email screenshot :

Email analysis :

NOTE : freemobilesupport@ovh.com
NOTE : Mime-Version : 1.0
NOTE : X-Sid-Pra : freemobilesupport@ovh.com
NOTE : Authentication-Results : hotmail.com; spf=neutral
NOTE : (sender IP is 212.227.17.10)

NOTE : Received : from serv567468 ([13.69.255.41])

NOTE : by mrelayeu.kundenserver.de (mreue103)

Phishing analysis :

CLICK : http://www.free,fr/login/compte/facture_n11-553167929/
OPEN : http://www.iab.una.py/images/imagenes/r13/r3.html
REDIRECT :

https://gator2011.hostgator.com/~contacte/espace.mobile.free.fr.moncompte/login/*/

REDIRECT :

https://gator2011.hostgator.com/~contacte/espace.mobile.free.fr.moncompte/login/*/moncompte/index.php?clientid=*&default=*

SCREENSHOT :

CLICK : Se connecter

CLICK : Ajouter ma carte bancaire

CLICK : Confirmer ma carte bancaire
REDIRECT :

https://gator2011.hostgator.com/~contacte/espace.mobile.free.fr.moncompte/login/*/moncompte/send.php

SCREENSHOT :

REDIRECT : http://portail.free.fr/

The crisis has finished! Work with us!

Hello!

We are looking for employees working remotely.

My name is Lynette, am the personnel manager of a large International company. Most of the work you can do from home, that is, at a distance. Salary is $2500-$5000. If you are interested in this offer, please visit Our Site

Best regards!

Email analysis :

NOTE : Received : from adsl.viettel.vn (unknown [115.79.167.71])

NOTE : client-ip=115.79.167.71;
NOTE : User-Agent : Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17)
NOTE : Gecko/20110414 Thunderbird/3.1.10
NOTE : vr6.mail.ovh.net [149.202.197.43]

Attn: Consignment Box Owner.

Attn: Consignment Box Owner.

Sorry for this unexpected message to you. I am Richard Paul, a Security Manager at the Dayton International Airport, Dayton Ohio, USA. During a recent routine check at all Security/Storage Units at the airport, I discovered an abandoned shipment in your name coming from Nigeria which was on Transit to your city but was intercepted by the Dayton International Airport Security for lack of proper clearance papers as the consignment was scanned and discovered to contain valuable cash between US$4.5Million US Dollars in estimation that was not properly declared to the authorities since the tags on the consignment showed the item contains Personal Belongings/ Family Treasures which is not in regulations to the delivery requirements by The Transportation Security Administration (TSA) so in this regards, the consignment was placed on hold until proper clearances are provided by a reliable Government source. The details on the consignment are tagged as:

Type: SUITCASE
Wheels: 4 wheels
Handles: Trolley handle with top & side handles
Approximate Dimensions: Height: 3.20 ft, Width: 2.50 ft, Depth: 1.90 ft.
Weight: 180lbs.

However, be informed that the reason I have taken it upon myself as a Security Manager at the Dayton International Airport to contact you personally about this abandoned shipment is because I am a GOD fearing man and i would not want you to loose your consignment box since the box has not yet been returned to the United states Treasury Department for further inspection after being abandoned by the shipper so immediately the confirmation is made, I will go ahead with all negotiations with the airport authorities for the release of the consignment box to me as your representative so I can arrange for the delivery to your city since the encoded Tag on the Bill of entry for the consignment was declared as personal effect so the reconciliation of Correct Manifest information as Valuable cash in the new Bill of entry is needed before the release can be implemented.

Lastly, to enable me confirm if you are the actual recipient of this consignment Box, I will advise you get back to me as quick as possible and re-confirm your address so that i can be sured that the box is going to the rightful owner, also list the closest airport to you to enable me cross check if it corresponds with the address on the official documents including the normalization of your Bill of Entry and arrange for the box to be moved out of this Airport to your address. Once we are through with this process.

Please confirm your information:

1.Full Names:
2.Home Address:
4.Country:
5.Your Cell Number/Home:

For confidentiality purposes,i will advise you to email my private email, for quick processing and response to you, kindly send and confirm your details to my private email account ( richarddppaul@gmail.com ) so we can act swiftly.

Regards,
Richard Paul
Security/Inspection Manager
Dayton International Airport
3600 Terminal Dr, Dayton, OH 45377, United States.

Email analysis :

NOTE : richarddppaul@gmail.com
NOTE : admin@wx163.cn
NOTE : Received : from [107.150.49.199];

APPROVED BY UNITED NATIONS.

INTERNATIONAL FUNDS AUDIT UNIT
UNITED NATIONS LIAISON OFFICE NEW-YORK, USA
870 UNITED NATIONS PLAZA 20-A NEW YORK NY 10017
OUR REF: US/NF/UN/XX2016

FUND US1.5MILLION APPROVED BY UNITED NATIONS

Attn Beneficiary,

We write to inform you that Series of meetings have been held over the past 2weeks with the Secretary General of the United Nations Organization, International Community Board and U.S.Department of State and Africa Union Organization this ended last week. During the meeting, this organization discovered that you have not received your funds due to past corrupt Governmental Officials who almost held the fund to themselves for their selfish reason and some individuals who have taken advantage of your fund all in an attempt to swindle your fund which has led to so many losses from your end and unnecessary delay in the receipt of your fund. The International Community Board Committee enhanced by the United Nations/ U.S.Department of State and Africa Union Organization have successfully passed a payment mandate release order to the Bank to clear all over due Contract funds, Lottery winnings and Inheritance funds owed to you and other individuals and organizations who have been found not to have receive their funds. Note that your payment file submitted to the Bank in question is 1.5Million U.S Dollars. In order to know you are ready to receive your approved fund, you are strictly advice to furnish us with the below information for us to cross check in our payment file if is correct, and after all verification, we will then direct you on how to contact the Bank for your fund payment to you.

1. Your Full Name:
2. Address:
3. Home/Cell Phone:
4. Age and Marital Status:
5. Occupation:
6. Any Identification like Int'l Passport/Driver License:

We expecting your urgent response to this email to enable us monitor this payment effectively.

Yours faithfully

Mrs.Theresa Lewis

Assistance Secretary United Nation

Email analysis :

NOTE : lewistheresa@yandex.com
NOTE : qaz@opgufyigfhypooj.tk
NOTE : X-Originating-Ip : [109.74.203.116]

Vous avez un message (Phishing Crédit Agricole)

Bonjour,

Un nouveau message est disponible sur votre messagerie.

Pour le consulter, Veuiller Cliquez sur le lien ce-dessous:

Cliquez ici

Nous vous remercions de votre confiance.

Ce courriel vous a ete envoye par un systeme automatique d emission de messages.
L adresse d emission n est pas une adresse de courriel classique.
Si vous a cette adresse, votre message ne sera pas pris en compte

Email screenshot :

Email analysis :

NOTE : noreply@nrj.fr
NOTE : X-Dinascanner : Este E-Mail no ha sido analizado.
NOTE : Return-Path : < generalconsultora@vl927.dinaserver.com >
NOTE : X-Dinascanner-From : generalconsultora@vl927.dinaserver.com
NOTE : Mime-Version : 1.0
NOTE : Content-Transfer-Encoding : 8bit
NOTE : X-Mailer : PHPMailer [version 1.73]
NOTE : Content-Type : text/html; charset="iso-8859-1"
NOTE : Received : from vl927.dinaserver.com ([82.98.176.158])
NOTE : Received : by vl927.dinaserver.com (Postfix, from userid 1004)
NOTE : Vous avez un message

Phishing analysis :

CLICK : Cliquez ici
OPEN : http://www.conseiller-fr-ca.com/zdh//
REDIRECT : http://id-ca-secure.com/login/*/particulier.html?agricole=_banque-run&secure=*
NOTE : THIS PHISHING IS SIMILAR TO THIS PHISHING.
NOTE : SWITCH TO DOMAINS ANALYSIS.

id-ca-secure.com whois :

Domain Name: ID-CA-SECURE.COM
Registry Domain ID: 2035899334_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.vodien.com
Registrar URL: www.vodien.com
Updated Date: 2016-06-17T04:18:07Z
Creation Date: 2016-06-17T04:18:06Z
Registrar Registration Expiration Date: 2017-06-17T04:18:06Z
Registrar: Vodien Internet Solutions Pte Ltd
Registrar IANA ID: 1912
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registrant Name: Josceline BRIALLON
Registrant Organization: N/A
Registrant Street: 23 rue Jeanne d'Arc
Registrant City: Paris
Registrant State/Province: Paris
Registrant Postal Code: 75001
Registrant Country: FR
Registrant Phone: +33.0152896325
Registrant Email: zszeos@gmail.com
Registry Admin ID:
Admin Name: Josceline BRIALLON
Admin Organization: N/A
Admin Street: 23 rue Jeanne d'Arc
Admin City: Paris
Admin State/Province: Paris
Admin Postal Code: 75001
Admin Country: FR
Admin Phone: +33.0152896325
Admin Email: zszeos@gmail.com
Registry Tech ID:
Tech Name: Josceline BRIALLON
Tech Organization: N/A
Tech Street: 23 rue Jeanne d'Arc
Tech City: Paris
Tech State/Province: Paris
Tech Postal Code: 75001
Tech Country: FR
Tech Phone: +33.0152896325
Tech Email: zszeos@gmail.com
Name Server: ns1.singaporehost.sg
Name Server: ns2.singaporehost.sg
Name Server: ns3.singaporehost.sg
DNSSEC:Unsigned
Registrar Abuse Contact Email: domain@vodien.com
Registrar Abuse Contact Phone: +65.62886264

conseiller-fr-ca.com whois :

Domain Name: CONSEILLER-FR-CA.COM
Registry Domain ID: 2035898903_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.vodien.com
Registrar URL: www.vodien.com
Updated Date: 2016-06-17T04:09:26Z
Creation Date: 2016-06-17T04:09:25Z
Registrar Registration Expiration Date: 2017-06-17T04:09:25Z
Registrar: Vodien Internet Solutions Pte Ltd
Registrar IANA ID: 1912
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Josceline BRIALLON
Registrant Organization: N/A
Registrant Street: 23 rue Jeanne d'Arc
Registrant City: Paris
Registrant State/Province: Paris
Registrant Postal Code: 75001
Registrant Country: FR
Registrant Phone: +33.0152896325
Registrant Email: zszeos@gmail.com
Registry Admin ID:
Admin Name: Josceline BRIALLON
Admin Organization: N/A
Admin Street: 23 rue Jeanne d'Arc
Admin City: Paris
Admin State/Province: Paris
Admin Postal Code: 75001
Admin Country: FR
Admin Phone: +33.0152896325
Admin Email: zszeos@gmail.com
Registry Tech ID:
Tech Name: Josceline BRIALLON
Tech Organization: N/A
Tech Street: 23 rue Jeanne d'Arc
Tech City: Paris
Tech State/Province: Paris
Tech Postal Code: 75001
Tech Country: FR
Tech Phone: +33.0152896325
Tech Email: zszeos@gmail.com
Name Server: ns1.singaporehost.sg
Name Server: ns2.singaporehost.sg
Name Server: ns3.singaporehost.sg
DNSSEC:Unsigned

Disposition á propos de votre CB (Phishing Crédit Agricole)

Bonjour,

Suite á une erreur sur votre dernier achat.

Merci de bien vouloire regler votre dossier.

Veuiller Cliquez sur le lien ce-dessous:

Cliquez ici

Nous vous remercions pour votre confiance.
Cordialement,

Conseil d'administration.

Email screenshot :

Email analysis :

NOTE : aaaaa@leslipfrancais.fr
NOTE : Content-Type : text/html; charset=iso-8859-1
NOTE : Mime-Version : 1.0
NOTE : Return-Path : < www-data@leslipfrancais.fr >
NOTE : Received : from leslipfrancais.fr ([162.243.248.84])

NOTE : Received : by leslipfrancais.fr (Postfix, from userid 33)
NOTE : X-Php-Originating-Script : 0:galiane.php
NOTE : Message-Id : < *.*@leslipfrancais.fr >
NOTE : Disposition á propos de votre CB

Phishing analysis :

CLICK : Cliquez ici
OPEN : http://enter-ac.com/staff.php
NOTE : Phishing was an attempt and account was suspended.

Hello Dearest (Scam)

Hello Dearest

My name is susan, I saw your profile at Facebook and admire it, Please sorry for my embarrassment, I was only interested and wanted to know if we can develop honest relationship. I wish if is the will of God, we can start from here. But For better presentation kindly reach me back (susannabraham@hotmail.com) for more communication, As i did not say much about myself here,

Please reply to my PRIVATE email so that i can send you my photos and my details, I have a reason of contacting you, I have something very important to share with you, Please kindly write me through my email so that i will tell you the reason why i contacted you, here is my email, (susannabraham@hotmail.com) Hoping To Hear From You ,

Yours Susan

Abraham.

Email analysis :

NOTE : susannabraham@hotmail.com
NOTE : Received : from mail.undip.ac.id (localhost [127.0.0.1])
NOTE : by smtp.undip.ac.id (vPostMaster)
NOTE : Received : from smtp.undip.ac.id (rinjani.undip.ac.id. [182.255.0.91])

NOTE : User-Agent : Roundcube Webmail/RCMAIL_VERSION

smtp.undip.ac.id analysis :

OPEN : undip.ac.id
REDIRECT : http://www.undip.ac.id/v2/
SCREENSHOT :

TWITTER : @univ_diponegoro

18-06-2016 -- Mise a jour important (Phishing Crédit Agricole)

La Banque Postale

Votre situation

Bonjour,
Lors de votre dernier achat , vous avez été averti par un message vous informant de l'obligation d'adhérer à la nouvelle réglementation concernant la fiabilité pour les achats par C.B. sur internet et de la mise en place d'un arrêt pour vos futurs achats. Or, nous n'avons pas, ce jour, d'adhésion de votre part et nous sommes au regret de vous informer que vous pouvez plus utiliser votre carte sur internet.
.
Adhésion : Cliquez-ici

Nous vous remercions de la confiance que vous nous témoignez.
Cordialement,

CREDIT AGRICOLE

© CREDIT AGRICOLE 2016

Email screenshot :

Email analysis :

NOTE : creditagricoleinfo@ovh.com
NOTE : Mime-Version : 1.0
NOTE : X-Sid-Pra : creditagricoleinfo@ovh.com
NOTE : Content-Type : text/html; charset=utf-8
NOTE : Received : from lilyoude ([40.115.42.121])

NOTE : by mrelayeu.kundenserver.de
NOTE : 18-06-2016 -- Mise a jour important

Phishing analysis :

CLICK : Cliquez-ici
OPEN : http://www.iab.una.py/images/imagenes/r11/r13.html
REDIRECT : http://important.mise.a.jour.credit.agricole.identification-panel.com/login/*/particulier.html?agricole=_banque-run&secure=*
SCREENSHOT :

CLICK : Confirmer
REDIRECT : http://important.mise.a.jour.credit.agricole.identification-panel.com/login/*/information.php
SCREENSHOT :

CLICK : Valider / Confirmer
REDIRECT : http://important.mise.a.jour.credit.agricole.identification-panel.com/login/*/email.php
SCREENSHOT :

CLICK : Valider / Confirmer
REDIRECT : https://www.credit-agricole.fr/

Greetings to you from the DHL COURIER SERVICES WORLD WIDE

DHL OF NIGERIA Ltd
c913/3North Ridge Crescent Road
North Ridge, P.O Box 207 NIGERIA
E-Mail: revyoungmike@gmail.com

Dear

Greetings to you from the DHL COURIER SERVICES WORLD WIDE, we are writing to inform you that your ATM CARD was brought to our office in NIGERIA his Evening from the Bank Of US at about 3:37pm our time to be delivered to you this mouth 2016 my name, is Rev Mike Young, You are inspected to send your delivery address to us for delivery to commence. I was told by the director of Bank of US that this ATM card is given to you as a compensation to you due to the delayed of your Unclaimed Fund / Inheritance, also we discovered that your Parcel has been unnecessarily Delayed by corrupt officials in NIGERIA. The ATM Card are two each of them is Value is $5.500,000 USD Only . You are advised that a maximum withdrawal value of US$1,500.00 is permitted daily from any ATM machine that has the VISA Card Logo on it and the card have to be renewed in 4 years time which is 2019. Also with the ATM card you will be able to transfer your funds to your local bank account. The ATM card comes with a handbook or manual to enlighten you about how to use it. Even if you do not have a bank account. Please note that the ATM card is well packaged and cannot be opened because it is protected with a hard cover an insurance policy which makes it impossible for it to be used by any individual except by you the rightful beneficiary. All verifications has been made and you are the sole beneficiary of the funds, you are advice to pay the delivery charges of $85.usd to get your parcel deliver to you within 24 hours.

24 hours Delivery

Mailing……………….. $30.00
Insurance…………. $35.00
Vat (5%)……………..$20.00
Total…………………..$85.00

Payment of $85,usd should be sent to the DHL account officer from any Western Union Money Transfer or Money Gram Money Transfer location nearest to you, As soon as payment is confirm, you will be sent the tracking number to ascertain status of your card shipment..

DESCRIPTION OF PARCEL:

ATM card/original certificate of weight :—–0.20kg
Bonded draft of weight :——————0.17kg
Total weight of parcel :——————–0.37kg
Color of Parcel :—————————-Dark Brown
Length of days :——————————24hours
Delivery Type:——————————-Premium Service
Delivery Status:——————————Virtual Pending
Customer Number:————————–FRAl45771001

Your parcel contains the following documents:

1.Two Visa CARD VALUED THE SUM OF $5.500,000 USD Only
2.CLEAR SOURCE OF FUNDS CERTIFICATES(C.S.F.C…)
3.CERTIFICATES OF ORIGIN OF FUNDS(C.O.F.)

These documents have been securely sealed and packed for security reasons which makes it impossible for anyone to view it until its been delivered to you. Immediately you make the payment delivery is set to take place. please you are advice to send your delivery address to us in time so use the below information to make the payment of the $85.usd so that your package will be deliver to you ASAP. Below is the delivery details needed from you

Your full Name..
Your Delivery Address:..............
Home/Cell Phone:..............

Upon receipt of payment the delivery officer will ensure that your package is sent within 24 working hours. Because we are so sure of everything we are giving you a 100% money back guarantee if you do not receive payment/package within the next 24hrs after you have made the payment for shipping.

Receive's Name..........................OGWU VICTOR
Country........................................Nigeria
Test Question..............................In God
Answer.........................................We Trust
Amount...........................................$85.Dollars

I am waiting to hear from you as soon as your make the payment.
With best regards from the DHL COURIER SERVICE

REV. YOUNG MIKE

Dispatch Manager

DHL delivery service

we shall be communicating through email until you received the cards.

Email analysis :

NOTE : revmikeyoung@qq.com
NOTE : audrey@speedy.com.ar

From Dr.Isabella Jefferson

Hello dear friend,

I'M Dr.Isabella Jefferson I am a UNITED STATE MILITARY NURSE From united state of America. Am supportive and caring, looking forward to get a nice friend. I read your profile from professional link network and pick interest on you. I will like to establish mutual friendship with you. Please let continue our conversation through my private email box.Here is my email address ( drisabellajeffersonus@gmail.com ) I will introduce myself better and tell you the reason why i contact you also send you my picture as soon as i receive your mail.Thanks and regards.

Dr.Isabella Jefferson

Email analysis :

NOTE : aminadukson750@asia.com
NOTE : drisabellajeffersonus@gmail.com
NOTE : Received : from 41.82.51.166 ([41.83.30.153])

Congratulation you are one of BMW Lucky Winner Contact: bmw.automobile2016@gmail.com

Congratulation You are one of the ten(10) lucky 2016 end of the year promo
winner, please contact Game Manager to claim your price:
bmw.automobile2016@gmail.com

NOTE; delivery charges are winner responsibility

Email analysis :

NOTE : 203.86.24.211@lhr.comsats.net.pk
NOTE : bmw.automobile2016@gmail.com
NOTE : Received : from 197.211.53.45 (proxying for unknown)
NOTE : (SquirrelMail authenticated user oracle) by 210.56.16.10

Secure Message From Eric

g
G

Hello, I tried to upload and send earlier but got an error message, So i had to send it using Dropbox because it is safe and secure to share important document/files.

View|Download files

scan011.pdf
scan012.pdf

© 2016 Drop Box

Avast logo
This email has been checked for viruses by Avast antivirus software.
www.avast.com

File analysis :

CLICK : View|Download files
OPEN : http://goo.gl/OgPeo3
REDIRECT : http://timeinformatica.com.br/down.js/
RESULT : Unresponsive...

Email analysis :

NOTE : info@g-dss.com
NOTE : iluvtoteach56@aol.com
NOTE : Received : from LOBO (unknown [185.60.147.98])

NOTE : Colocore Gmbh
NOTE : client-ip=204.29.186.159;

Cordelia Adams

Dearest One,I am Mrs Cordelia person from Kuwait. I am married to Mr. Robert Adams. who worked with Kuwait embassy in Ivory Coast for Nine years before he died in the year 2010. We were married for eleven years without a child. He died after a brief illness that lasted for only four days.Before his death we were both born again Christian. Since his death I decided not to remarry or get a child outside my matrimonial home which the Bible is against. When my late husband was alive he deposited the sum of $6 Million (Six ) Million U.S. Dollars) in the bank here in a fixed suspence account and he declare me as the next of kin to the said fund.I would like to hear from you as soon as possible so that i can give you more details about the money Remain blessed in the Lord.Yours in Christ,Cordelia. Adams

Email analysis :

NOTE : cordelia.adams400@gmail.com
NOTE : cordeliaadams.1@gmail.com
NOTE : X-Rocketymmf : adamssjrit2012
NOTE : Received : from [41.207.14.165]